mirror of
https://github.com/microsoft/semantic-kernel.git
synced 2026-10-12 02:19:06 +00:00
dependabot/github_actions/actions/setup-dotnet-6.0.0
5080
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 SergeyMenshykhandCopilot
|
e6c9673684 |
.Net: Disable automatic HTTP redirects in HttpPlugin and WebFileDownloadPlugin default clients (#14132)
The default HTTP clients used by `HttpPlugin` and `WebFileDownloadPlugin` now have `AllowAutoRedirect` set to `false`. This ensures the `AllowedDomains` restriction is enforced consistently regardless of server responses. - Added `GetNonRedirectingHttpClient()` to `HttpClientProvider` (all target frameworks) - Updated both plugins to use non-redirecting clients by default - Added unit tests verifying redirect responses are not followed - Updated XML documentation Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
f25753be0a |
Bump Scriban from 7.2.0 to 7.2.5 to fix NU1902 vulnerability (#14133)
Fixes CI failure caused by NU1902 errors due to known moderate severity vulnerabilities in Scriban 7.2.0 (GHSA-6q7j-xr26-3h2c, GHSA-q6rr-fm2g-g5x8). Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
38a5480af0 |
Python: Default MCP SSE server samples to loopback with host validation (#14127)
## Motivation and Context The Python MCP server demos under `python/samples/demos/mcp_server/` can optionally run over the SSE transport (`--transport sse`). This updates that sample wiring to follow the Model Context Protocol guidance for local development servers, so developers who use these demos as a starting point inherit sensible defaults. ## Description - **Loopback by default**: the SSE samples now bind to `127.0.0.1` instead of `0.0.0.0`. A new `--host` argument makes binding to other interfaces an explicit opt-in that logs a warning. - **Host/Origin validation**: added Starlette `TrustedHostMiddleware` plus a small Origin allowlist middleware so the local listener only serves loopback callers (requests without an `Origin` header are still allowed, for non-browser MCP clients). - **Sample hygiene**: switched `Starlette(debug=True)` to `debug=False` so the demos don't ship verbose debug output. - **Docs**: the README now describes the loopback-by-default behavior, the `--host` opt-in, and points to the existing `mcp_with_oauth` sample for authenticated, network-reachable deployments. Applies to `sk_mcp_server.py` and `agent_as_server.py`. The stdio transport (the default) and the other stdio-only samples are unchanged. ## Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] I didn't break anyone 😄 --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
efa3268a09 |
Python: Enforce excluded_functions on MCP tool invocation path (#14124)
### Motivation and Context The MCP server created by `create_mcp_server_from_kernel` (and the `Kernel.as_mcp_server` wrapper) accepts an `excluded_functions` argument to keep selected kernel functions off the server. Previously this list was applied only when building the tool set advertised by the `list_tools` handler; the `call_tool` handler did not consult it and forwarded the client-supplied name straight to the kernel. As a result the set of advertised tools and the set of callable tools could diverge. ### Description - Derive a single `exposed_names` set from `functions_to_expose` and check it in the `call_tool` handler, returning a `METHOD_NOT_FOUND` error for any name that is not exposed. - Remove a leftover `print` debug statement in `_call_kernel_function`. - Add a unit test covering the `call_tool` behavior for a non-exposed function. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the SK Contribution Guidelines - [x] All unit tests pass, and I have added new tests where possible --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
dfc5227227 |
.Net: Update .NET SDK to 10.0.301 (#14119)
Updates the .NET SDK version in `dotnet/global.json` from `10.0.100` to `10.0.301`. Co-authored-by: Copilot <[email protected]> |
||
|
|
cf9af8b966 |
.Net: Bump axios to 1.16.0 and form-data to 4.0.6 in /dotnet/samples/Demos/ProcessFrameworkWithSignalR (#13858)
### Motivation and Context This update is required to resolve the current Dependabot security alerts for the sample npm manifest in `dotnet/samples/Demos/ProcessFrameworkWithSignalR`. ### Description Updates the sample manifest to require `axios` `^1.16.0` and regenerates the lockfile so the resolved dependency set includes: - `axios` `1.16.0` - `form-data` `4.0.6` - compatible transitive updates such as `follow-redirects` `1.16.0` These changes keep the scope limited to the sample's `package.json` and `package-lock.json` while clearing the reported npm audit findings for this manifest. ### Contribution Checklist - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: SergeyMenshykh <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
e99c633fba |
.Net: Harden file path validation in Core, Document, and Web plugins (#14118)
## Motivation and Context This change hardens file system path handling in the file-based plugins. Previously, the path used for allowlist validation could differ from the path ultimately used for file I/O, so the two operations were not guaranteed to refer to the same file system location. ## Description - Adds a shared `PathUtilities.GetSafeFullPath` helper that produces a canonical full path for a given input. - Updates `FileIOPlugin`, `SessionsPythonPlugin`, `DocumentPlugin` and `WebFileDownloadPlugin` to validate and perform I/O against the same canonical path, and to compare paths using OS-appropriate string comparison. - Adds regression tests covering the new behavior. ## Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the SK Contribution Guidelines - [x] All unit tests pass, and I have added new tests where possible --------- Co-authored-by: Copilot <[email protected]> |
||
|
dependabot[bot]andSergeyMenshykh
|
99d1953e93 |
Bump axios from 1.13.2 to 1.16.0 in /dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend (#14044)
Bumps [axios](https://github.com/axios/axios) from 1.13.2 to 1.16.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v1.16.0 — May 2, 2026</h2> <p>This release adds support for the QUERY HTTP method and a new <code>ECONNREFUSED</code> error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.</p> <h2>⚠️ Notable Changes</h2> <p>A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:</p> <ul> <li><strong>Fetch adapter now enforces <code>maxBodyLength</code> and <code>maxContentLength</code>.</strong> These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (<strong><a href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>)</li> <li><strong>Proxy requests now preserve user-supplied <code>Host</code> headers.</strong> Previously, the proxy path could overwrite a custom <code>Host</code>. Virtual-host-style routing through a proxy will now behave correctly. (<strong><a href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>)</li> <li><strong>Basic auth credentials embedded in URLs are now URL-decoded.</strong> If you have percent-encoded credentials in a URL (e.g. <code>https://user:p%40ss@host</code>), the decoded value is what now goes on the wire. (<strong><a href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li> <li><strong><code>parseProtocol</code> now strictly requires a colon in the protocol separator.</strong> Strings that loosely parsed as protocols before may no longer match. (<strong><a href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li> <li><strong>Deprecated <code>unescape()</code> replaced with modern UTF-8 encoding.</strong> Non-ASCII URL handling is now spec-correct; consumers depending on legacy <code>unescape()</code> quirks may see different output bytes. (<strong><a href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li> <li><strong><code>transformRequest</code> input typing change was reverted.</strong> The typing change introduced in <a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a> was reverted in <a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a> after follow-up review — net behavior is unchanged from 1.15.2. (<strong><a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>QUERY HTTP Method:</strong> Added support for the QUERY HTTP method across adapters and type definitions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10802">#10802</a></strong>)</li> <li><strong>ECONNREFUSED Error Constant:</strong> Exposed <code>ECONNREFUSED</code> as a constant on <code>AxiosError</code> so callers can match connection-refused failures without comparing string literals (closes <a href="https://redirect.github.com/axios/axios/issues/6485">#6485</a>). (<strong><a href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li> <li><strong>Encode Helper Export:</strong> Exported the internal <code>encode</code> helper from <code>buildURL</code> so userland param serializers can reuse the same encoding logic that axios uses internally. (<strong><a href="https://redirect.github.com/axios/axios/issues/6897">#6897</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>HTTP Adapter — Redirects & Headers:</strong> Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing <code>requestDetails</code> argument on <code>beforeRedirect</code>, preserved user-supplied <code>Host</code> headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (<strong><a href="https://redirect.github.com/axios/axios/issues/10794">#10794</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10800">#10800</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6241">#6241</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li> <li><strong>HTTP Adapter — Streams & Timeouts:</strong> Preserved the partial response object on <code>AxiosError</code> when a stream is aborted after headers arrive, honoured the <code>timeout</code> option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and <code>maxRedirects: 0</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10708">#10708</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10819">#10819</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7149">#7149</a></strong>)</li> <li><strong>Fetch Adapter:</strong> Enforced <code>maxBodyLength</code> / <code>maxContentLength</code> in the fetch adapter, set the <code>User-Agent</code> header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a <code>TypeError</code> in restricted environments. (<strong><a href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10772">#10772</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10806">#10806</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7260">#7260</a></strong>)</li> <li><strong>XHR Adapter:</strong> Unsubscribed the <code>cancelToken</code> and <code>AbortSignal</code> listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li> <li><strong>Error Handling:</strong> Attached the parsed response to <code>AxiosError</code> when <code>JSON.parse</code> fails inside <code>dispatchRequest</code>, prevented <code>settle</code> from emitting <code>undefined</code> error codes, and tightened the <code>parseProtocol</code> regex to require a colon in the protocol separator. (<strong><a href="https://redirect.github.com/axios/axios/issues/10724">#10724</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7276">#7276</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li> <li><strong>Types & Exports:</strong> Aligned the CommonJS <code>CancelToken</code> typings with the ESM build, fixed a compiler error caused by <code>RawAxiosHeaders</code>, and re-exported <code>create</code> from the package index. (<strong><a href="https://redirect.github.com/axios/axios/issues/7414">#7414</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6389">#6389</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6460">#6460</a></strong>)</li> <li><strong>UTF-8 Encoding:</strong> Replaced the deprecated <code>unescape()</code> call with a modern UTF-8 encoding implementation. (<strong><a href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li> <li><strong>Misc Cleanup:</strong> Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (<strong><a href="https://redirect.github.com/axios/axios/issues/10833">#10833</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li><strong>Refactor — ES6 Modernisation:</strong> Modernised the <code>utils</code> module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (<strong><a href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li> <li><strong>Tests:</strong> Hardened the HTTP test server lifecycle to fix flaky <code>FormData</code> EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (<strong><a href="https://redirect.github.com/axios/axios/issues/10820">#10820</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10791">#10791</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10796">#10796</a></strong>)</li> <li><strong>Docs:</strong> Documented <code>paramsSerializer.encode</code> for strict RFC 3986 query encoding, updated the <code>parseReviver</code> TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (<strong><a href="https://redirect.github.com/axios/axios/issues/10821">#10821</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10782">#10782</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10759">#10759</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10804">#10804</a></strong>)</li> <li><strong>Reverted:</strong> Reverted the <code>transformRequest</code> input typing change from <a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a> after follow-up review. (<strong><a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li> <li><strong>Dependencies:</strong> Bumped <code>actions/setup-node</code>, the <code>github-actions</code> group, and <code>postcss</code> (in <code>/docs</code>) to their latest versions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10785">#10785</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10813">#10813</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10814">#10814</a></strong>)</li> <li><strong>Release:</strong> Updated changelog and packages, and prepared the 1.16.0 release. (<strong><a href="https://redirect.github.com/axios/axios/issues/10790">#10790</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10834">#10834</a></strong>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/singhankit001"><code>@singhankit001</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>)</li> <li><strong><a href="https://github.com/cuiweixie"><code>@cuiweixie</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li> <li><strong><a href="https://github.com/iruizsalinas"><code>@iruizsalinas</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li> <li><strong><a href="https://github.com/MarcosNocetti"><code>@MarcosNocetti</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li> <li><strong><a href="https://github.com/deepview-autofix"><code>@deepview-autofix</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h2>v1.16.0 — May 2, 2026</h2> <p>This release adds support for the QUERY HTTP method and a new <code>ECONNREFUSED</code> error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.</p> <h2>⚠️ Notable Changes</h2> <p>A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:</p> <ul> <li><strong>Fetch adapter now enforces <code>maxBodyLength</code> and <code>maxContentLength</code>.</strong> These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (<strong><a href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>)</li> <li><strong>Proxy requests now preserve user-supplied <code>Host</code> headers.</strong> Previously, the proxy path could overwrite a custom <code>Host</code>. Virtual-host-style routing through a proxy will now behave correctly. (<strong><a href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>)</li> <li><strong>Basic auth credentials embedded in URLs are now URL-decoded.</strong> If you have percent-encoded credentials in a URL (e.g. <code>https://user:p%40ss@host</code>), the decoded value is what now goes on the wire. (<strong><a href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li> <li><strong><code>parseProtocol</code> now strictly requires a colon in the protocol separator.</strong> Strings that loosely parsed as protocols before may no longer match. (<strong><a href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li> <li><strong>Deprecated <code>unescape()</code> replaced with modern UTF-8 encoding.</strong> Non-ASCII URL handling is now spec-correct; consumers depending on legacy <code>unescape()</code> quirks may see different output bytes. (<strong><a href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li> <li><strong><code>transformRequest</code> input typing change was reverted.</strong> The typing change introduced in <a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a> was reverted in <a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a> after follow-up review — net behavior is unchanged from 1.15.2. (<strong><a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>QUERY HTTP Method:</strong> Added support for the QUERY HTTP method across adapters and type definitions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10802">#10802</a></strong>)</li> <li><strong>ECONNREFUSED Error Constant:</strong> Exposed <code>ECONNREFUSED</code> as a constant on <code>AxiosError</code> so callers can match connection-refused failures without comparing string literals (closes <a href="https://redirect.github.com/axios/axios/issues/6485">#6485</a>). (<strong><a href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li> <li><strong>Encode Helper Export:</strong> Exported the internal <code>encode</code> helper from <code>buildURL</code> so userland param serializers can reuse the same encoding logic that axios uses internally. (<strong><a href="https://redirect.github.com/axios/axios/issues/6897">#6897</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>HTTP Adapter — Redirects & Headers:</strong> Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing <code>requestDetails</code> argument on <code>beforeRedirect</code>, preserved user-supplied <code>Host</code> headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (<strong><a href="https://redirect.github.com/axios/axios/issues/10794">#10794</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10800">#10800</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6241">#6241</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li> <li><strong>HTTP Adapter — Streams & Timeouts:</strong> Preserved the partial response object on <code>AxiosError</code> when a stream is aborted after headers arrive, honoured the <code>timeout</code> option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and <code>maxRedirects: 0</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10708">#10708</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10819">#10819</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7149">#7149</a></strong>)</li> <li><strong>Fetch Adapter:</strong> Enforced <code>maxBodyLength</code> / <code>maxContentLength</code> in the fetch adapter, set the <code>User-Agent</code> header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a <code>TypeError</code> in restricted environments. (<strong><a href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10772">#10772</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10806">#10806</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7260">#7260</a></strong>)</li> <li><strong>XHR Adapter:</strong> Unsubscribed the <code>cancelToken</code> and <code>AbortSignal</code> listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li> <li><strong>Error Handling:</strong> Attached the parsed response to <code>AxiosError</code> when <code>JSON.parse</code> fails inside <code>dispatchRequest</code>, prevented <code>settle</code> from emitting <code>undefined</code> error codes, and tightened the <code>parseProtocol</code> regex to require a colon in the protocol separator. (<strong><a href="https://redirect.github.com/axios/axios/issues/10724">#10724</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7276">#7276</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li> <li><strong>Types & Exports:</strong> Aligned the CommonJS <code>CancelToken</code> typings with the ESM build, fixed a compiler error caused by <code>RawAxiosHeaders</code>, and re-exported <code>create</code> from the package index. (<strong><a href="https://redirect.github.com/axios/axios/issues/7414">#7414</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6389">#6389</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6460">#6460</a></strong>)</li> <li><strong>UTF-8 Encoding:</strong> Replaced the deprecated <code>unescape()</code> call with a modern UTF-8 encoding implementation. (<strong><a href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li> <li><strong>Misc Cleanup:</strong> Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (<strong><a href="https://redirect.github.com/axios/axios/issues/10833">#10833</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li><strong>Refactor — ES6 Modernisation:</strong> Modernised the <code>utils</code> module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (<strong><a href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li> <li><strong>Tests:</strong> Hardened the HTTP test server lifecycle to fix flaky <code>FormData</code> EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (<strong><a href="https://redirect.github.com/axios/axios/issues/10820">#10820</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10791">#10791</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10796">#10796</a></strong>)</li> <li><strong>Docs:</strong> Documented <code>paramsSerializer.encode</code> for strict RFC 3986 query encoding, updated the <code>parseReviver</code> TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (<strong><a href="https://redirect.github.com/axios/axios/issues/10821">#10821</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10782">#10782</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10759">#10759</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10804">#10804</a></strong>)</li> <li><strong>Reverted:</strong> Reverted the <code>transformRequest</code> input typing change from <a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a> after follow-up review. (<strong><a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li> <li><strong>Dependencies:</strong> Bumped <code>actions/setup-node</code>, the <code>github-actions</code> group, and <code>postcss</code> (in <code>/docs</code>) to their latest versions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10785">#10785</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10813">#10813</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10814">#10814</a></strong>)</li> <li><strong>Release:</strong> Updated changelog and packages, and prepared the 1.16.0 release. (<strong><a href="https://redirect.github.com/axios/axios/issues/10790">#10790</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10834">#10834</a></strong>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/singhankit001"><code>@singhankit001</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>)</li> <li><strong><a href="https://github.com/cuiweixie"><code>@cuiweixie</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li> <li><strong><a href="https://github.com/iruizsalinas"><code>@iruizsalinas</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li> <li><strong><a href="https://github.com/MarcosNocetti"><code>@MarcosNocetti</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li> <li><strong><a href="https://github.com/deepview-autofix"><code>@deepview-autofix</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc"><code>df53d7d</code></a> chore(release): prepare release 1.16.0 (<a href="https://redirect.github.com/axios/axios/issues/10834">#10834</a>)</li> <li><a href="https://github.com/axios/axios/commit/9d92bcd32639d1eea5b89f03ae45f248d3bb058e"><code>9d92bcd</code></a> fix: gadgets and smaller issues (<a href="https://redirect.github.com/axios/axios/issues/10833">#10833</a>)</li> <li><a href="https://github.com/axios/axios/commit/5107ee69aee527b19eabaf80000ca65752135435"><code>5107ee6</code></a> fix: prevent undefined error codes in settle (<a href="https://redirect.github.com/axios/axios/issues/7276">#7276</a>)</li> <li><a href="https://github.com/axios/axios/commit/e57349992f230b6b13e80613eb84302560aa5ba8"><code>e573499</code></a> fix(fetch): defer global access in fetch adapter (<a href="https://redirect.github.com/axios/axios/issues/7260">#7260</a>)</li> <li><a href="https://github.com/axios/axios/commit/ad68e1a484b50086af427f767bbd7d6e3aab7ac3"><code>ad68e1a</code></a> fix(http): honor timeout during connect without redirects (<a href="https://redirect.github.com/axios/axios/issues/10819">#10819</a>)</li> <li><a href="https://github.com/axios/axios/commit/2a51828213128691d2e37502b5eb2cf4965a737d"><code>2a51828</code></a> fix(http): decode URL basic auth credentials (<a href="https://redirect.github.com/axios/axios/issues/10825">#10825</a>)</li> <li><a href="https://github.com/axios/axios/commit/0e8b6bbb542131bae9940618d84d5286255d4db1"><code>0e8b6bb</code></a> fix(http): preserve user-supplied Host header when forwarding through a proxy...</li> <li><a href="https://github.com/axios/axios/commit/79f39e1d041dca87173226d0255f90eaf252564b"><code>79f39e1</code></a> docs: document paramsSerializer.encode for strict RFC 3986 query encoding (<a href="https://redirect.github.com/axios/axios/issues/1">#1</a>...</li> <li><a href="https://github.com/axios/axios/commit/0fe3a5fc14829535e1d517c662d448e86c33438e"><code>0fe3a5f</code></a> [Docs/Types] Update <code>parseReviver</code> TypeScript definitions for ES2023 and add ...</li> <li><a href="https://github.com/axios/axios/commit/cd6737fd84bdb7caf2a319d3579573a49f9d238d"><code>cd6737f</code></a> chore: matches the sibling responseStream.on(aborted) handler and added tests...</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v1.13.2...v1.16.0">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for axios since your current version.</p> </details> <details> <summary>Install script changes</summary> <p>This version modifies <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: SergeyMenshykh <[email protected]> |
||
|
westey
|
82f244233b |
.Net: Update SK to use MEVD packages and move MEVD projects out of main solution (#14117)
### Motivation and Context - The MEVD packages are not shipped from this repo anymore. ### Description - Moving the packages out of the main SK solution - Update all projects to use MEVD.Abstractions package directly - Revert some previous code changes to make the MEVD implementations compatible with the last MEVD.Abstractions package released from this repo. ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
SergeyMenshykhandCopilot
|
88e1060b99 |
Python: Adjust request validation (#14114)
Updates request validation behavior and related tests. --------- Co-authored-by: Copilot <[email protected]> |
||
|
Eduard van ValkenburgandCopilot
|
83bffe197b |
Python: Add OpenAPI server URL validation (#14097)
## Summary - Add server URL validation for Python OpenAPI operation execution before outbound requests are made - Add execution settings for trusted allowed base URLs and private-network access - Pass operation arguments into server variable resolution and add regression coverage for substituted server hosts ## Testing - `uv run pytest tests/unit/connectors/openapi_plugin/test_server_url_validator.py tests/unit/connectors/openapi_plugin/test_openapi_runner.py tests/unit/connectors/openapi_plugin/test_openapi_manager.py tests/unit/connectors/openapi_plugin/test_sk_openapi.py` - `uv run pytest tests/integration/cross_language/test_cross_language.py -k openapi` - `uv run ruff check ...` - `uv run ruff format --check ...` --------- Co-authored-by: Copilot <[email protected]> |
||
|
dependabot[bot]
|
00bad6fed1 |
Bump mistune from 3.2.0 to 3.2.1 in /python (#13965)
Bumps [mistune](https://github.com/lepture/mistune) from 3.2.0 to 3.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lepture/mistune/releases">mistune's releases</a>.</em></p> <blockquote> <h2>v3.2.1</h2> <h3> 🐞 Bug Fixes</h3> <ul> <li>Resolve Windows compatibility issues in file inclusion and tests - by <a href="https://github.com/Yuki9814"><code>@Yuki9814</code></a> <a href="https://github.com/lepture/mistune/commit/2547102"><!-- raw HTML omitted -->(25471)<!-- raw HTML omitted --></a></li> <li>Escape html text - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/a3cb6e5"><!-- raw HTML omitted -->(a3cb6)<!-- raw HTML omitted --></a></li> <li>Update link reference - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/85eb54f"><!-- raw HTML omitted -->(85eb5)<!-- raw HTML omitted --></a></li> <li>Handle escaped dollar signs in inline math - by <a href="https://github.com/saschabuehrle"><code>@saschabuehrle</code></a> in <a href="https://redirect.github.com/lepture/mistune/issues/370">lepture/mistune#370</a> <a href="https://github.com/lepture/mistune/commit/7bd5709"><!-- raw HTML omitted -->(7bd57)<!-- raw HTML omitted --></a></li> <li>Escape id of toc - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/04880a0"><!-- raw HTML omitted -->(04880)<!-- raw HTML omitted --></a></li> <li>Escape id of headings - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/2855622"><!-- raw HTML omitted -->(28556)<!-- raw HTML omitted --></a></li> <li>Remove double-encoding of image alt text - by <a href="https://github.com/lawrence3699"><code>@lawrence3699</code></a> <a href="https://github.com/lepture/mistune/commit/0d6f3d8"><!-- raw HTML omitted -->(0d6f3)<!-- raw HTML omitted --></a></li> <li>Escape xml for math plugin - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/5fa092e"><!-- raw HTML omitted -->(5fa09)<!-- raw HTML omitted --></a></li> <li>Use strict regex for image's height and width - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/8d0cb75"><!-- raw HTML omitted -->(8d0cb)<!-- raw HTML omitted --></a></li> </ul> <h5> <a href="https://github.com/lepture/mistune/compare/v3.2.0...v3.2.1">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/lepture/mistune/blob/main/docs/changes.rst">mistune's changelog</a>.</em></p> <blockquote> <h2>Version 3.2.1</h2> <p><strong>Released on May 3, 2026</strong></p> <ul> <li>Escape link in <code>render_toc_ul</code>.</li> <li>Escape text in math plugin.</li> <li>Fix regex for math plugin.</li> <li>Escape heading's ID attribute.</li> <li>Fix <code>LINK_TITLE_RE</code> to prevent DoS.</li> <li>Escape class attribute for admonition directive.</li> <li>Remove double-encoding of image alt text.</li> <li>Escape class attribute for image directive.</li> <li>Fix width/height attribute for image directive.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lepture/mistune/commit/067f90861088a496942f5eb43236135352b85d39"><code>067f908</code></a> chore: release 3.2.1</li> <li><a href="https://github.com/lepture/mistune/commit/bf5503067a7d8c3b065fb143f67a3a08eca77bb6"><code>bf55030</code></a> Merge pull request <a href="https://redirect.github.com/lepture/mistune/issues/438">#438</a> from saschabuehrle/fix/issue-370</li> <li><a href="https://github.com/lepture/mistune/commit/8d0cb7539a9ac82e633b98476b9922632eb8b948"><code>8d0cb75</code></a> fix: use strict regex for image's height and width</li> <li><a href="https://github.com/lepture/mistune/commit/5fa092e3053b86f16e4c49b9d3ba0b7ab63f09ab"><code>5fa092e</code></a> fix: escape xml for math plugin</li> <li><a href="https://github.com/lepture/mistune/commit/71ec9477ebfcf8dab0068804baf2c77461d77fbb"><code>71ec947</code></a> Merge pull request <a href="https://redirect.github.com/lepture/mistune/issues/440">#440</a> from lawrence3699/fix/image-alt-double-encoding</li> <li><a href="https://github.com/lepture/mistune/commit/0d6f3d850283d51e9c60e5a1b3c9343a18df3722"><code>0d6f3d8</code></a> fix: remove double-encoding of image alt text</li> <li><a href="https://github.com/lepture/mistune/commit/2855622d7fe235c6c805716edff943b5945d1eea"><code>2855622</code></a> fix: escape id of headings</li> <li><a href="https://github.com/lepture/mistune/commit/04880a004cb28318e5ebd7ee9e63c79fc9f9ed04"><code>04880a0</code></a> fix: escape id of toc</li> <li><a href="https://github.com/lepture/mistune/commit/7bd57096715385062505b3f78972be9fa823d6d4"><code>7bd5709</code></a> fix: handle escaped dollar signs in inline math (fixes <a href="https://redirect.github.com/lepture/mistune/issues/370">#370</a>)</li> <li><a href="https://github.com/lepture/mistune/commit/85eb54ff17da26327399bf188f9ff9b8fd515278"><code>85eb54f</code></a> fix: update link reference</li> <li>Additional commits viewable in <a href="https://github.com/lepture/mistune/compare/v3.2.0...v3.2.1">compare view</a></li> </ul> </details> <br /> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
16085866f8 |
Bump urllib3 from 2.6.3 to 2.7.0 in /python (#13978)
### Motivation and Context Bumps <a href="https://github.com/urllib3/urllib3">urllib3</a> from 2.6.3 to 2.7.0 across the Python project, including the `mcp_with_oauth` demo, to pick up the latest security and bug fixes. ### Description - Bumps `urllib3` from 2.6.3 to 2.7.0 in `python/uv.lock` - Bumps `urllib3` from 2.5.0 to 2.7.0 in `python/samples/demos/mcp_with_oauth/uv.lock` so the demo no longer resolves an older urllib3 version ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: Evan Mattson <[email protected]> |
||
|
dependabot[bot]
|
22ee3e0032 |
Python: Bump authlib from 1.6.11 to 1.6.12 in /python (#14004)
Bumps [authlib](https://github.com/authlib/authlib) from 1.6.11 to 1.6.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/authlib/authlib/releases">authlib's releases</a>.</em></p> <blockquote> <h2>v1.6.12</h2> <ul> <li> <ul> <li>Fix redirecting to unvalidated <code>redirect_uri</code> on <code>InvalidScopeError</code> in <code>OpenIDImplicitGrant</code> and <code>OpenIDHybridGrant</code>. <strong>Full Changelog</strong>: <a href="https://github.com/authlib/authlib/compare/v1.6.11...v1.6.12">https://github.com/authlib/authlib/compare/v1.6.11...v1.6.12</a></li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/authlib/authlib/blob/1.6.12/docs/changelog.rst">authlib's changelog</a>.</em></p> <blockquote> <h2>Version 1.6.12</h2> <p><strong>Released on may 4, 2026</strong></p> <ul> <li>Fix redirecting to unvalidated <code>redirect_uri</code> on <code>InvalidScopeError</code> in <code>OpenIDImplicitGrant</code> and <code>OpenIDHybridGrant</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/authlib/authlib/commit/e46e515b3a87ea63ab0606b248d75f69d83a2391"><code>e46e515</code></a> chore: bump to 1.6.12</li> <li><a href="https://github.com/authlib/authlib/commit/9babc131e13b018a267ae78747cba7caa6dfb7d5"><code>9babc13</code></a> fix: redirecting to unvalidated redirect_uri on InvalidScopeError in OIDC grants</li> <li>See full diff in <a href="https://github.com/authlib/authlib/compare/v1.6.11...1.6.12">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
326ecbecd9 |
Python: Bump idna from 3.11 to 3.15 in /python (#14024)
Bumps [idna](https://github.com/kjd/idna) from 3.11 to 3.15. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/kjd/idna/blob/master/HISTORY.md">idna's changelog</a>.</em></p> <blockquote> <h2>3.15 (2026-05-12)</h2> <ul> <li>Enforce DNS-length cap on individual labels early in <code>check_label</code>, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.</li> <li>Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared <code>_unicode_dots_re</code> from <code>idna.core</code> in the codec module.</li> <li>Use <code>raise ... from err</code> for proper exception chaining and switch internal string formatting to f-strings.</li> <li>Allow <code>flit_core</code> 4.x in the build backend.</li> <li>Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.</li> <li>Add Dependabot configuration for GitHub Actions.</li> <li>Convert README and HISTORY from reStructuredText to Markdown.</li> <li>Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.</li> </ul> <p>Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.</p> <h2>3.14 (2026-05-10)</h2> <ul> <li>Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]</li> </ul> <p>Thanks to Stan Ulbrych for reporting the issue.</p> <h2>3.13 (2026-04-22)</h2> <ul> <li>Correct classification error for codepoint U+A7F1</li> </ul> <h2>3.12 (2026-04-21)</h2> <ul> <li>Update to Unicode 17.0.0.</li> <li>Issue a deprecation warning for the transitional argument.</li> <li>Added lazy-loading to provide some performance improvements.</li> <li>Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.</li> </ul> <p>Thanks to Rodrigo Nogueira for contributions to this release.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8"><code>af30a09</code></a> Release 3.15</li> <li><a href="https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2"><code>30314d4</code></a> Pre-release 3.15rc0</li> <li><a href="https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9"><code>05d4b21</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/237">#237</a> from kjd/convert-docs-to-markdown</li> <li><a href="https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee"><code>2987fdb</code></a> Convert README and HISTORY from reStructuredText to Markdown</li> <li><a href="https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c"><code>59fa800</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/236">#236</a> from kjd/dependabot/github_actions/actions-f3e34333ea</li> <li><a href="https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2"><code>def6983</code></a> Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea</li> <li><a href="https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631"><code>bbd8004</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/234">#234</a> from StanFromIreland/patch-1</li> <li><a href="https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc"><code>edd07c0</code></a> Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group</li> <li><a href="https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123"><code>5557db0</code></a> Merge branch 'master' into patch-1</li> <li><a href="https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d"><code>f11746c</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/235">#235</a> from StanFromIreland/patch-2</li> <li>Additional commits viewable in <a href="https://github.com/kjd/idna/compare/v3.11...v3.15">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
f6f47a298c |
Bump pyarrow from 21.0.0 to 23.0.1 in /python (#14058)
Bumps [pyarrow](https://github.com/apache/arrow) from 21.0.0 to 23.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/arrow/releases">pyarrow's releases</a>.</em></p> <blockquote> <h2>Apache Arrow 23.0.1</h2> <p>Release Notes URL: <a href="https://arrow.apache.org/release/23.0.1.html">https://arrow.apache.org/release/23.0.1.html</a></p> <h2>Apache Arrow 23.0.1 RC0</h2> <p>Release Notes: Release Candidate: 23.0.1 RC0</p> <h2>Apache Arrow 23.0.0</h2> <p>Release Notes URL: <a href="https://arrow.apache.org/release/23.0.0.html">https://arrow.apache.org/release/23.0.0.html</a></p> <h2>Apache Arrow 23.0.0 RC2</h2> <p>Release Notes: Release Candidate: 23.0.0 RC2</p> <h2>Apache Arrow 22.0.0</h2> <p>Release Notes URL: <a href="https://arrow.apache.org/release/22.0.0.html">https://arrow.apache.org/release/22.0.0.html</a></p> <h2>Apache Arrow 22.0.0 RC1</h2> <p>Release Notes: Release Candidate: 22.0.0 RC1</p> <h2>Apache Arrow 22.0.0 RC0</h2> <p>Release Notes: Release Candidate: 22.0.0 RC0</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/arrow/commit/82a374e5f3de5b744f26591e6cd96de6349c76d9"><code>82a374e</code></a> MINOR: [Release] Update versions for 23.0.1</li> <li><a href="https://github.com/apache/arrow/commit/c1ae37c4a597f466b1806e65a9e011be1060dfc5"><code>c1ae37c</code></a> MINOR: [Release] Update .deb/.rpm changelogs for 23.0.1</li> <li><a href="https://github.com/apache/arrow/commit/8f6e55736f60f1f95aee1e8765c6b75ad9589111"><code>8f6e557</code></a> MINOR: [Release] Update CHANGELOG.md for 23.0.1</li> <li><a href="https://github.com/apache/arrow/commit/4e16a1aeed83a65e6b49556c2fed8e9061cdf980"><code>4e16a1a</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49159">GH-49159</a>: [C++][Gandiva] Detect overflow in repeat() (<a href="https://redirect.github.com/apache/arrow/issues/49160">#49160</a>)</li> <li><a href="https://github.com/apache/arrow/commit/985621dbfcf3fd2061889e43c50b59825df84f3f"><code>985621d</code></a> <a href="https://redirect.github.com/apache/arrow/issues/48817">GH-48817</a> [R][C++] Bump C++20 in R build infrastructure (<a href="https://redirect.github.com/apache/arrow/issues/48819">#48819</a>)</li> <li><a href="https://github.com/apache/arrow/commit/1bea06ad4e14d75dd97a78a0148cd9cf6f4df0bc"><code>1bea06a</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49024">GH-49024</a>: [CI] Update Debian version in <code>.env</code> (<a href="https://redirect.github.com/apache/arrow/issues/49032">#49032</a>)</li> <li><a href="https://github.com/apache/arrow/commit/147bcd6d8f3fef05dd06968d3b60c17721c60334"><code>147bcd6</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49156">GH-49156</a>: [Python] Require GIL for string comparison (<a href="https://redirect.github.com/apache/arrow/issues/49161">#49161</a>)</li> <li><a href="https://github.com/apache/arrow/commit/e4f922b1621b6c833f583cf26500f115ab5bc483"><code>e4f922b</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49138">GH-49138</a>: [Packaging][Python] Remove nightly cython install from manylinux wh...</li> <li><a href="https://github.com/apache/arrow/commit/f9376e4721b81bad9fe3fe840926a3283f95ee30"><code>f9376e4</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49003">GH-49003</a>: [C++] Don't consider <code>out_of_range</code> an error in float parsing (<a href="https://redirect.github.com/apache/arrow/issues/49095">#49095</a>)</li> <li><a href="https://github.com/apache/arrow/commit/ab2c0ad6b23d05d5f77fc8a34d5a1c4baaacb0a4"><code>ab2c0ad</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49044">GH-49044</a>: [CI][Python] Fix test_download_tzdata_on_windows by adding required...</li> <li>Additional commits viewable in <a href="https://github.com/apache/arrow/compare/apache-arrow-21.0.0...apache-arrow-23.0.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]andGitHub Copilot
|
03f73aee5e |
Python: Bump torch from 2.8.0 to 2.12.0 in /python (#14065)
Bumps [torch](https://github.com/pytorch/pytorch) from 2.8.0 to 2.12.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pytorch/pytorch/releases">torch's releases</a>.</em></p> <blockquote> <h1>PyTorch 2.12.0 Release Notes</h1> <ul> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#highlights">Highlights</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes">Backwards Incompatible Changes</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#deprecations">Deprecations</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#new-features">New Features</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#improvements">Improvements</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes">Bug fixes</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#performance">Performance</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#documentation">Documentation</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#developers">Developers</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#security">Security</a></li> </ul> <h1>Highlights</h1> <!-- raw HTML omitted --> <p>For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.</p> <h1>Backwards Incompatible Changes</h1> <h2>Build Frontend</h2> <ul> <li> <p>Strengthened SVE compile checks in <code>FindARM.cmake</code>, which may reject previously accepted but incorrect SVE configurations (<a href="https://redirect.github.com/pytorch/pytorch/pull/176646">#176646</a>)</p> <p>Source builds that enable SVE now validate the compiler configuration more strictly. If a build previously passed with an incomplete or mismatched SVE setup, it may now fail during CMake configuration instead of later in compilation. Update the compiler/toolchain flags so they accurately describe the target SVE support, or disable SVE for that build.</p> </li> <li> <p>Updated the minimum CUDA version required to build PyTorch from source to CUDA 12.6 (<a href="https://redirect.github.com/pytorch/pytorch/pull/178925">#178925</a>)</p> <p>Building PyTorch from source with CUDA versions older than 12.6 is no longer supported. Users building custom binaries should install CUDA 12.6 or newer and make sure <code>CUDA_HOME</code> points to that installation.</p> <p>Version 2.11:</p> <pre lang="bash"><code>CUDA_HOME=/usr/local/cuda-12.4 python setup.py develop </code></pre> <p>Version 2.12:</p> <pre lang="bash"><code>CUDA_HOME=/usr/local/cuda-12.6 python setup.py develop </code></pre> </li> <li> <p>Enforced a C++20 minimum in CMake build files (<a href="https://redirect.github.com/pytorch/pytorch/pull/178662">#178662</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pytorch/pytorch/commit/0d62256a2b23365f8e1604297eb23a6545102aa8"><code>0d62256</code></a> [release] Dockerfile: skip torchaudio install when CUDA_PATH=cu132 (<a href="https://redirect.github.com/pytorch/pytorch/issues/183346">#183346</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/7661cd9c6b841b62b7f411aa52ec51f05457263b"><code>7661cd9</code></a> [MPS] Fix SDPA wrong output for permuted q/k/v with B > 1 (<a href="https://redirect.github.com/pytorch/pytorch/issues/181886">#181886</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/9da6087ab64ab6a2118686420ca5353c90dd7e1f"><code>9da6087</code></a> Fix stale PYTORCH_RELEASES_CODE_CC dict (fixes <a href="https://redirect.github.com/pytorch/pytorch/issues/182250">#182250</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182369">#182369</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/e4c37cc011d47246ce8ea4b99c9b28fb7f400224"><code>e4c37cc</code></a> Avoid raw stream name collisions in Inductor (<a href="https://redirect.github.com/pytorch/pytorch/issues/182178">#182178</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/822d047dc8dd8d919f83c3ad5c786e405075d1f0"><code>822d047</code></a> [MPS] Fix bool mask handling in 1-pass SDPA decode kernel (<a href="https://redirect.github.com/pytorch/pytorch/issues/182285">#182285</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182311">#182311</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/5c5e523cd520e6986006e45be243b3ee927ea546"><code>5c5e523</code></a> Add enable_gqa parameter to SDPA MPS meta registration (<a href="https://redirect.github.com/pytorch/pytorch/issues/181550">#181550</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/eece52ead16886e5463c3dcee9b04db783cc68d5"><code>eece52e</code></a> [AOTI] Add BC-safe c_shim v2 for _scaled_dot_product_attention_math_for_mps e...</li> <li><a href="https://github.com/pytorch/pytorch/commit/b39330bbe210b9628207e84d8ba2cabb7975fbac"><code>b39330b</code></a> [Inductor] Call latest c_shim version for versioned fallback ops (<a href="https://redirect.github.com/pytorch/pytorch/issues/181548">#181548</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/06f10d088229a25ac52bd14b6cacc04a4161f6ca"><code>06f10d0</code></a> Revert "[FSDP2] add fqn to communication ops" (<a href="https://redirect.github.com/pytorch/pytorch/issues/182100">#182100</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182157">#182157</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/449e3393139a1aca9afec120c9a63f98f12d55b0"><code>449e339</code></a> Revert "[Inductor] Improve materialization heuristic for a chain of computaio...</li> <li>Additional commits viewable in <a href="https://github.com/pytorch/pytorch/compare/v2.8.0...v2.12.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: GitHub Copilot <[email protected]> |
||
|
dependabot[bot]andcopilot-swe-agent[bot]
|
91efa2120c |
Python: Bump bleach from 6.3.0 to 6.4.0 in /python (#14089)
Bumps [bleach](https://github.com/mozilla/bleach) from 6.3.0 to 6.4.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/mozilla/bleach/blob/main/CHANGES">bleach's changelog</a>.</em></p> <blockquote> <h2>Version 6.4.0 (June 5th, 2026)</h2> <p><strong>NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues.</strong> See issue: <code><https://github.com/mozilla/bleach/issues/698></code>__</p> <p><strong>Backwards incompatible changes</strong></p> <ul> <li>Dropped support for pypy 3.10. (<a href="https://redirect.github.com/mozilla/bleach/issues/764">#764</a>)</li> </ul> <p><strong>Security fixes</strong></p> <ul> <li> <p>Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.</p> <p>Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.</p> <p>For example::</p> <p>import bleach payload1 = '<!-- raw HTML omitted -->Click<!-- raw HTML omitted -->' result1 = bleach.clean(payload1) print(repr(result1))</p> <p>outputs::</p> <p>'<!-- raw HTML omitted -->Click<!-- raw HTML omitted -->'</p> <p>See the advisory for details.</p> </li> <li> <p>Fix GHSA-gj48-438w-jh9v.</p> <p>Fix issue where URI sanitization wasn't happening in formaction attributes.</p> <p>See the advisory for details.</p> </li> </ul> <p><strong>Bug fixes</strong></p> <ul> <li> <p>Add support for pypy 3.11. (<a href="https://redirect.github.com/mozilla/bleach/issues/764">#764</a>)</p> </li> <li> <p>Drop version max in tinycss2 pin. (<a href="https://redirect.github.com/mozilla/bleach/issues/772">#772</a>)</p> <p>This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mozilla/bleach/commit/f0355a7af00500482c5292c6c83290c6a178068d"><code>f0355a7</code></a> fix: fix last release date in CHANGES</li> <li><a href="https://github.com/mozilla/bleach/commit/ae4e8a26706516ad01b92e66321b480208a440da"><code>ae4e8a2</code></a> chore: bleach 6.4.0 and final release</li> <li><a href="https://github.com/mozilla/bleach/commit/970df58e9f0c55cc52244f3f0106e473a40d886d"><code>970df58</code></a> fix: uri-sanitization in formaction attributes</li> <li><a href="https://github.com/mozilla/bleach/commit/7c4867c32344d1c961107fae62240a6f0dc680dc"><code>7c4867c</code></a> fix: xss bypass in allowed protocol test using unicode invisible characters</li> <li><a href="https://github.com/mozilla/bleach/commit/913ab75992b845e2c9c060c41f24d46921db4693"><code>913ab75</code></a> fix: reduce redundancy in workflow jobs</li> <li><a href="https://github.com/mozilla/bleach/commit/218c15af455c8dec14f98fcb2e235f8680e93930"><code>218c15a</code></a> fix: rework pip caching</li> <li><a href="https://github.com/mozilla/bleach/commit/4f0b097bf80548a022050e2f71f024d755a9f154"><code>4f0b097</code></a> fix: fix tox platform restrictions</li> <li><a href="https://github.com/mozilla/bleach/commit/e95a79d07bb5d792425c2bc0ef5dd03f6614f3bb"><code>e95a79d</code></a> chore: update pytest</li> <li><a href="https://github.com/mozilla/bleach/commit/91539d4e80d4685b8f2bedc79076ff0ff6c1b911"><code>91539d4</code></a> Bump actions/cache from 5.0.3 to 5.0.4</li> <li><a href="https://github.com/mozilla/bleach/commit/cd47b4ce495859065da23c2116f651e591e1e90d"><code>cd47b4c</code></a> fix: handle left-angle-bracket that's not a tag (<a href="https://redirect.github.com/mozilla/bleach/issues/733">#733</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mozilla/bleach/compare/v6.3.0...v6.4.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> |
||
|
dependabot[bot]andwestey
|
8ce2bcc07f |
.Net: Bump Aspire.Hosting.Azure.CognitiveServices from 13.0.0 to 13.3.0 (#13996)
Updated [Aspire.Hosting.Azure.CognitiveServices](https://github.com/microsoft/aspire) from 13.0.0 to 13.3.0. <details> <summary>Release notes</summary> _Sourced from [Aspire.Hosting.Azure.CognitiveServices's releases](https://github.com/microsoft/aspire/releases)._ ## 13.3.0 # Aspire 13.3.0 Aspire 13.3 is here! 🚀 This release is packed with new ways to deploy, debug, and build distributed apps — including `aspire destroy`, browser telemetry in the dashboard, Kubernetes deployment, first-class JavaScript publishing, and major TypeScript AppHost parity improvements. ## Highlights - 🧹 **Clean teardown** — New **`aspire destroy`** tears down Azure, Kubernetes, and Docker Compose deployments, and pipeline summaries make deploy/publish/destroy runs easier to follow. - 🔍 **Frontend telemetry** — **Aspire.Hosting.Browsers** captures browser console logs, network requests, and screenshots right in the Aspire dashboard. - ☸️ **Kubernetes deploy preview** — **`aspire deploy`** can now generate Helm-based Kubernetes deployments, with first-class Ingress and Gateway API routing. - 🟨 **JavaScript publishing** — New **`PublishAs*`** methods support static sites, Node servers, npm-script apps, Next.js, Vite, Bun, Yarn, and pnpm. - 🌐 **TypeScript AppHost parity** — Unified `withEnvironment`, Docker Compose hooks, endpoint expressions, Azure Container Apps domains, and more close the gap with C# AppHosts. - 🛠️ **CLI upgrades** — Run the standalone dashboard with **`aspire dashboard run`**, install the CLI as a NativeAOT `dotnet tool`, and search API docs from the terminal. - ☁️ **Azure goodness** — New Azure Front Door, Network Security Perimeter, AKS, private endpoint, and Foundry Prompt Agent support. - 🐳 **Better containers** — The Aspire container tunnel is now enabled by default for consistent host connectivity across Docker Desktop, Docker Engine, and Podman. ## ⚠️ Breaking changes Notable breaking changes include `--log-level` becoming `--pipeline-log-level`, the dashboard MCP server being replaced by `aspire agent init`, `dotnet new aspire-py-starter` moving to `aspire new aspire-py-starter`, and several API shape updates across AKS, Foundry, JavaScript diagnostics, and TypeScript AppHost helpers. See the full list in the [Aspire 13.3 breaking changes](https://aspire.dev/whats-new/aspire-13-3/#%EF%B8%8F-breaking-changes). ## 📖 Learn more For the full details, examples, migration guidance, and everything new in this release, check out [What's new in Aspire 13.3](https://aspire.dev/whats-new/aspire-13-3/). Thank you to all the community contributors who helped make Aspire 13.3 possible! 💜 ## 13.2.4 # Aspire 13.2.4 ## What's New in Aspire 13.2.4 Patch release addressing a security advisory in OpenTelemetry dependencies. ### 🐛 Fixes - 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#16420) ### 🏷️ Housekeeping - 🚀 Bumped branding to 13.2.4 (#16436) ## 13.2.3 # What's New in Aspire 13.2.3 Patch release focused on CLI packaging, signing, and reliability fixes. ## 🐛 Fixes - 🛑 aspire stop now properly cleans up application containers on Windows (#16123) - 🔐 Fixed macOS signing, permissions, and certificate trust with improved CI verification (#16053) - ✍️ Fixed signing for the aspire-managed bundle payload (#16211) - 🎭 Fixed Playwright CLI provenance verification for the new tag format (#16134) - 🧭 Updated service discovery environment variables (#16223) ## 🔧 Improvements - 📊 Removed telemetry API data limits and refactored URL builders (#16023) - ⏱️ Increased native build + sign timeout to 60 minutes for reliability (#16212) ## 🏷️ Housekeeping - 🔖 Bumped branding to 13.2.3 (#16181) - 🧪 Temporarily disabled Verify CLI archive step on Windows while investigating (#16276, #16285) ## 13.2.2 This is a servicing release focused on bug fixes and platform improvements. 🐛 Bug Fixes - Fix SqlClient runtime asset layout on Unix — Resolved an issue where Microsoft.Data.SqlClient failed to load correctly on macOS and Linux due to incorrect NuGet asset layout (#15709) - Fix IDE execution regressions for Azure Functions and class library projects — Backported fixes for 13.2 regressions impacting IDE-based execution (#15714) - Fix NpmRunner multi-version output parsing — npm view returning multiple versions no longer breaks version resolution; also bumps @playwright/cli to >=0.1.3 (#15746) - Skip name validation for internal resources — ProjectRebuilderResource, installer, and venv creator resources no longer fail the 64-char name limit since they're never deployed (#15726, fixes #15693) 🔒 Security & Certificates - Use ASP.NET Core dev cert for DCP — Avoids ephemeral certificate trust issues by using the standard ASP.NET Core developer certificate (#15718) - Cache PFX dev certs on Windows and Linux — Prevents binary-level changes between runs for persistent container scenarios (#15774) 🏗️ Infrastructure & Platform - ARM64 CLI support — Added win-arm64 and linux-arm64 to the native CLI archive build matrix (#15599) - Update DCP to 0.22.11 (#15713) 💻 CLI Improvements - Show anonymous dashboard URLs in aspire ps — The dashboard URL is now displayed even when running without authentication (#15731 ## 13.2.1 🐛 Bug Fixes - 🖥️ CLI bundles for ARM & musl — win-arm64, linux-arm64, and linux-musl-x64 bundles now correctly include DCP instead of silently producing broken installs (#15529) - ⚡ aspire new in VS Code — Fixed a race where the workspace switch severed the CLI terminal before the agent init prompt could complete (#15553) - 🔗 Dashboard resource URLs — The describe command no longer produces broken dashboard links with a stray /login?t=... in the path (#15495) - 🌍 Guest AppHost env vars — Launch profile environment variables are now correctly forwarded to guest AppHosts (#15637) - 📦 Legacy settings migration — .aspire/settings.json → aspire.config.json migration was silently skipped in some scenarios; now works reliably (#15526) - 🔧 TypeScript AppHost restore — Fixed config resolution during TS AppHost restore (#15625) - 🎭 Playwright CLI on Windows — aspire agent init now correctly installs playwright-cli on Windows (#15559) - 📌 Emulator stability — Pinned Kusto emulator image and improved Cosmos DB emulator reliability (#15504) ✨ Improvements - 🏗️ Brownfield TypeScript aspire init — Running aspire init in existing JS/TS projects now smartly merges package.json — scripts, dependencies, and engines — with semver-aware conflict handling (#15123) - 🎯 Endpoint filtering — New ExcludeReferenceEndpoint property lets you filter specific endpoints from WithReference (#15586) - 🌐 More polyglot ATS APIs — Exported additional hosting APIs for TypeScript and Go AppHost authoring (#15557) - 🔍 Short trace ID support — The dashboard now resolves short trace IDs in addition to full-length ones (#15613) - ⚠️ Aspire.Hosting.NodeJs deprecated — Use Aspire.Hosting.JavaScript instead; the old package no longer appears in aspire add (#15686) ## 13.2.0 # Aspire 13.2 Aspire 13.2 brings major CLI enhancements, a new TypeScript AppHost (preview), dashboard data export/import, Microsoft Foundry integration, and multi-language improvements — all focused on making local development more streamlined for developers and AI coding agents alike. ## Highlights - 🛠️ CLI overhaul — New commands including **aspire start/stop/ps** for detached mode, **aspire describe** for resource monitoring, **aspire doctor** for environment diagnostics, **aspire secret** for managing user secrets, **aspire docs** for browsing documentation from the terminal, and **aspire agent** (renamed from **aspire mcp**) for AI agent integration. - 🌐 TypeScript AppHost (preview) — Write your apphost in TypeScript with **createBuilder()**, using the same app model concepts as C#. Full VS Code extension support included. - 🧩 VS Code extension — Dedicated Aspire Activity Bar panel with live resource state, inline CodeLens with health status and actions, gutter decorations, and a new Getting Started walkthrough. - 📊 Dashboard improvements — Bulk telemetry export/import, export environment variables as **.env** files, a new telemetry HTTP API, set parameters directly from the dashboard, and improved resource graph layout. - 🤖 Microsoft Foundry — Replaces Azure AI Foundry integration with broader **Aspire.Hosting.Foundry** support including hosted agents and model deployments. - 🔒 Azure Virtual Network & Private Endpoints — New **Aspire.Hosting.Azure.Network** integration for defining VNets, subnets, NAT gateways, NSGs, and private endpoints directly in your apphost. - 🐳 Docker Compose publishing — Generate docker-compose.yaml from your app model with **AddDockerComposeEnvironment.** - 📦 New integrations — Azure Data Lake Storage, MongoDB EF Core (**Aspire.MongoDB.EntityFrameworkCore**), Bun support for JS resources, and Certbot for automated SSL certificates. - ⚡ App model — **WithMcpServer** for declaring MCP endpoints, **rebuild** command for project resources, contextual endpoint resolution, and improved secret/certificate handling. ## ⚠️ Breaking changes Notable breaking changes include service discovery env vars now using endpoint scheme instead of name, aspire.config.json replacing split config files, AIFoundry → Foundry rename, WithSecretBuildArg → WithBuildSecret, and updated default Azure credential behavior. [See the full list of breaking changes](https://aspire.dev/whats-new/aspire-13-2/#%EF%B8%8F-breaking-changes). ## 📖 Learn more For the full details on everything in this release, check out the [What's new in Aspire 13.2](https://aspire.dev/whats-new/aspire-13-2/) documentation. Thank you to all the community contributors who helped make this release happen! 💜 ## 13.1.3 ## What's Changed * [release/13.1] Add installer publishing updates for 13.1.3 by @radical in https://github.com/dotnet/aspire/pull/15158 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.2...v13.1.3 ## 13.1.2 ## What's Changed * Bump patch version from 13.1.1 to 13.1.2 by @Copilot in https://github.com/dotnet/aspire/pull/14699 * [release/13.1] Fix template version parsing for .NET 10.0 SDK separator change by @JamesNK in https://github.com/dotnet/aspire/pull/14698 * Update pipeline images to non-deprecated pools by @joperezr in https://github.com/dotnet/aspire/pull/14707 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.1...v13.1.2 ## 13.1.1 ## What's Changed * [release/13.1] Ensure WithHostHttpsPort works when chained inline by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13678 * [release/13.1] Escape backslashes in path string to discovered vite config by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13822 * [release/13.1] [Testing] Fixing bugs for sticky slot app settings by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13810 * [release/13.1] Fix AzureBicepResource file-not-found error when using templateFile with AzurePublishingContext by @github-actions[bot] in https://github.com/dotnet/aspire/pull/14018 * [release/13.1] Filter dev certs without X509SubjectKeyIdentifierExtension when any cert has it by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13676 * [release/13.1] Fix Aspire.ProjectTemplates build failure from command line length limits by @github-actions[bot] in https://github.com/dotnet/aspire/pull/14009 * [release/13.1] Update Azure.Identity package version to 1.17.1 by @eerhardt in https://github.com/dotnet/aspire/pull/14251 * Bump patch version from 13.1.0 to 13.1.1 by @Copilot in https://github.com/dotnet/aspire/pull/14329 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.0...v13.1.1 ## 13.1.0 We are excited to share that our 13.1.0 release of Aspire has shipped! All of the packages are available in NuGet.org now. Head over to https://aspire.dev/whats-new/aspire-13-1/ to find what's new in 13.1.0! ## What's Changed * Target net10.0 in client integrations by @eerhardt in https://github.com/dotnet/aspire/pull/12500 * Fix DockerComposeEnvironment duplicating image names in .env file by @Copilot in https://github.com/dotnet/aspire/pull/12310 * Replace apt-get with npm for Azure Functions Core Tools installation by @Copilot in https://github.com/dotnet/aspire/pull/12537 * Improve flaky dashboard integration test by @JamesNK in https://github.com/dotnet/aspire/pull/12534 * Add README.md for the Aspire.Hosting.Azure.AppService package by @ShilpiRach in https://github.com/dotnet/aspire/pull/12528 * Add support to enable automatic scaling for App Service Environment by @ShilpiRach in https://github.com/dotnet/aspire/pull/12305 * Update to FluentUI 4.13.1 by @JamesNK in https://github.com/dotnet/aspire/pull/12532 * Skip playground projects in build-packages workflow by @Copilot in https://github.com/dotnet/aspire/pull/12547 * Allow HostUrl to remap both address and port by @danegsta in https://github.com/dotnet/aspire/pull/12521 * Refactor NodeJs Integration by @eerhardt in https://github.com/dotnet/aspire/pull/12530 * Fix MCP endpoint with redirect HTTPS by @JamesNK in https://github.com/dotnet/aspire/pull/12556 * [main] Update dependencies from microsoft/usvc-apiserver by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12540 * Refactor AddNodeApp by @eerhardt in https://github.com/dotnet/aspire/pull/12538 * Update Aspire branding from 13.0 to 13.1 by @Copilot in https://github.com/dotnet/aspire/pull/12527 * Add annotation to specify custom base images for generated Dockerfiles by @Copilot in https://github.com/dotnet/aspire/pull/12566 * Fix generating random MCP endpoint URL in templates by @JamesNK in https://github.com/dotnet/aspire/pull/12558 * [CI] Add new Agent for disabling or quarantining tests by @radical in https://github.com/dotnet/aspire/pull/12570 * Add `ExcludeFromMcp()` resource extension by @JamesNK in https://github.com/dotnet/aspire/pull/12515 * Localized file check-in by OneLocBuild Task: Build definition ID 1309: Build ID 2828818 by @dotnet-bot in https://github.com/dotnet/aspire/pull/12546 * Register IPipelineOutputService in DI for pipeline output directory management by @Copilot in https://github.com/dotnet/aspire/pull/12563 * Add deploy support for Docker Compose by @captainsafia in https://github.com/dotnet/aspire/pull/12548 * Quarantine flaky test: AzureServiceBusEmulatorResourceGeneratesConfigJsonWithCustomizations by @Copilot in https://github.com/dotnet/aspire/pull/12578 * Update connection properties for non-Azure resources by @sebastienros in https://github.com/dotnet/aspire/pull/12583 * Filter to highest package version per channel in aspire add command by @Copilot in https://github.com/dotnet/aspire/pull/12553 * Log DCP messages at Debug/Trace level in AppHost by @Copilot in https://github.com/dotnet/aspire/pull/12533 * Add CLI self-update prompts to `aspire update` command by @Copilot in https://github.com/dotnet/aspire/pull/12395 * Fix golang and alpine images. by @mitchdenny in https://github.com/dotnet/aspire/pull/12592 * Replace ContainerTargetPlatform.AllLinux with LinuxAmd64 by @Copilot in https://github.com/dotnet/aspire/pull/12596 * [main] Update dependencies from microsoft/usvc-apiserver by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12610 * Make IReportingStep and IReportingTask completion idempotent by @Copilot in https://github.com/dotnet/aspire/pull/12602 * Show --log-level debug hint when pipeline fails by @Copilot in https://github.com/dotnet/aspire/pull/12603 * [main] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12622 * Rename app.py to main.py in template by @eerhardt in https://github.com/dotnet/aspire/pull/12628 * bump extension version by @adamint in https://github.com/dotnet/aspire/pull/12623 * don't build apphost in cli when running in extension by @adamint in https://github.com/dotnet/aspire/pull/12621 * Detect which version of yarn is being used by @eerhardt in https://github.com/dotnet/aspire/pull/12633 * Fix duplicate key exception when using WithExplicitStart() on resources with environment callbacks by @Copilot in https://github.com/dotnet/aspire/pull/12604 * Support AddCSharpApp, fix some rough edges around project resources by @adamint in https://github.com/dotnet/aspire/pull/12568 * Add missing namespace to `CertificateAuthorityCollectionResource` by @danegsta in https://github.com/dotnet/aspire/pull/12639 * Add ModelContextProtocol assemblies to signing list by @joperezr in https://github.com/dotnet/aspire/pull/12637 * Generate fallback Dockerfile for Python apps without UV by @Copilot in https://github.com/dotnet/aspire/pull/12627 * Update/bump container image tags for hosting components by @joperezr in https://github.com/dotnet/aspire/pull/12459 * Mark IDeveloperCertificateService experimental by @danegsta in https://github.com/dotnet/aspire/pull/12648 * Wait with exponential backoff for expected Executables by @karolz-ms in https://github.com/dotnet/aspire/pull/12647 * Make ProcessCertificateTrustConfigAsync internal by @danegsta in https://github.com/dotnet/aspire/pull/12649 * Add test cases and ensure container cert override paths work by @danegsta in https://github.com/dotnet/aspire/pull/12654 * Python hosting: Support .venv lookup by walking up parent directories by @Copilot in https://github.com/dotnet/aspire/pull/12616 ... (truncated) ## 13.0.2 This patch is updating our Project Templates for our Python starter app to ensure we depend on the latest version of React. This is out of an abundance of caution, as we don't depend on any of the react packages that were flagged as vulnerable in https://github.com/advisories/GHSA-fv66-9v8q-g76r. ## What's Changed * Bump patch version from 13.0.1 to 13.0.2 by @Copilot in https://github.com/dotnet/aspire/pull/13324 * Update React and ReactDOM to version 19.2.1 across all projects by @joperezr in https://github.com/dotnet/aspire/pull/13325 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.0.1...v13.0.2 ## 13.0.1 ## What's Changed * Merge internal changes by @joperezr in https://github.com/dotnet/aspire/pull/12896 * [release/13.0] Fix Azure roles resources always redeploying by @github-actions[bot] in https://github.com/dotnet/aspire/pull/12903 * [release/13.0] Remove .py and .js files from being signed (#13005) by @eerhardt in https://github.com/dotnet/aspire/pull/13032 * [release/13.0] Fix subscription ID not being disabled on Azure provisioning dialog by @github-actions[bot] in https://github.com/dotnet/aspire/pull/12913 * [release/13.0] Default OpenAISettings.EnableSensitiveTelemetryData to TelemetryHelpers.EnableSensitiveDataDefault by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13017 * Bump patch version from 13.0.0 to 13.0.1 by @Copilot in https://github.com/dotnet/aspire/pull/13167 * [release/13.0] EndpointReference evaluation should wait on missing AllocatedEndpoint (#13074) by @karolz-ms in https://github.com/dotnet/aspire/pull/13076 * [release/13.0] Update to Npgsql 10 by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13166 * [release/13.0] Update dependencies from microsoft/usvc-apiserver by @danegsta in https://github.com/dotnet/aspire/pull/13187 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.0.0...v13.0.1 Commits viewable in [compare view](https://github.com/microsoft/aspire/compare/v13.0.0...v13.3.0). </details> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: westey <[email protected]> |
||
|
|
20be253d7b |
.Net: Bump esbuild, @vitejs/plugin-react, vite, and transitive lockfile deps in /dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend (#14070)
### Motivation and Context This PR updates the ReactFrontend build toolchain dependencies and also resolves additional Dependabot alerts that target the same frontend lockfile manifests. ### Description - Removes `esbuild` (no longer directly used) - Updates `@vitejs/plugin-react` from `4.3.4` to `6.0.2` - Updates `vite` from `6.4.1` to `8.0.16` - Updates transitive lockfile entries in `package-lock.json` and `yarn.lock` for: - `js-yaml` to `4.2.0` - `ws` to `7.5.11` - `mdast-util-to-hast` to `13.2.1` These dependency updates were kept scoped to `dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend`. ### Contribution Checklist - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: Evan Mattson <[email protected]> |
||
|
|
13f812b825 |
Python: Update pymongo requirement from <4.16,>=4.8.0 to >=4.8.0,<4.17 in /python (#13866)
Updates the requirements on [pymongo](https://github.com/mongodb/mongo-python-driver) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mongodb/mongo-python-driver/releases">pymongo's releases</a>.</em></p> <blockquote> <h2>PyMongo 4.16.0</h2> <p>Community notes: <!-- raw HTML omitted --></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/mongodb/mongo-python-driver/blob/master/doc/changelog.rst">pymongo's changelog</a>.</em></p> <blockquote> <h2>Changes in Version 4.16.0 (2026/01/07)</h2> <p>PyMongo 4.16 brings a number of changes including:</p> <ul> <li>Removed invalid documents from :class:<code>bson.errors.InvalidDocument</code> error messages as doing so may leak sensitive user data. Instead, invalid documents are stored in :attr:<code>bson.errors.InvalidDocument.document</code>.</li> <li>PyMongo now requires <code>dnspython>=2.6.1</code>, since <code>dnspython</code> 1.0 is no longer maintained. The minimum version is <code>2.6.1</code> to account for <code>CVE-2023-29483 <https://www.cve.org/CVERecord?id=CVE-2023-29483></code>_.</li> <li>Removed support for Eventlet. Eventlet is actively being sunset by its maintainers and has compatibility issues with PyMongo's dnspython dependency.</li> <li>Use Zstandard support from the standard library for Python 3.14+, and use <code>backports.zstd</code> for older versions.</li> <li>Fixed return type annotation for <code>find_one_and_*</code> methods on :class:<code>~pymongo.asynchronous.collection.AsyncCollection</code> and :class:<code>~pymongo.synchronous.collection.Collection</code> to include <code>None</code>.</li> <li>Added support for NumPy 1D-arrays in :class:<code>bson.binary.BinaryVector</code>.</li> <li>Prevented :class:<code>~pymongo.encryption.ClientEncryption</code> from loading the crypt shared library to fix "MongoCryptError: An existing crypt_shared library is loaded by the application" unless the linked library search path is set.</li> </ul> <h2>Changes in Version 4.15.5 (2025/12/02)</h2> <p>Version 4.15.5 is a bug fix release.</p> <ul> <li>Fixed a bug that could cause <code>AutoReconnect("connection pool paused")</code> errors when cursors fetched more documents from the database after SDAM heartbeat failures.</li> </ul> <h2>Changes in Version 4.15.4 (2025/10/21)</h2> <p>Version 4.15.4 is a bug fix release.</p> <ul> <li>Relaxed the callback type of :meth:<code>~pymongo.asynchronous.client_session.AsyncClientSession.with_transaction</code> to allow the broader Awaitable type rather than only Coroutine objects.</li> <li>Added the missing Python 3.14 trove classifier to the package metadata.</li> </ul> <p>Issues Resolved ...............</p> <p>See the <code>PyMongo 4.15.4 release notes in JIRA</code>_ for the list of resolved issues in this release.</p> <p>.. _PyMongo 4.15.4 release notes in JIRA: <a href="https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=47237">https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=47237</a></p> <h2>Changes in Version 4.15.3 (2025/10/07)</h2> <p>Version 4.15.3 is a bug fix release.</p> <ul> <li>Fixed a memory leak when raising :class:<code>bson.errors.InvalidDocument</code> with C extensions.</li> <li>Fixed the return type of the :meth:<code>~pymongo.asynchronous.collection.AsyncCollection.distinct</code>,</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/32901018ca14d9acb05004a88d65b6ab0b29c877"><code>3290101</code></a> Prepare 4.16.0 release (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2672">#2672</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/1be94d262dd0281b032b6f9e56d381cac3a7a6d9"><code>1be94d2</code></a> PYTHON-5685 Fix unified spec sync metadata for csot and sessions tests (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2669">#2669</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/6585d9cb51d5c9b2d85eec4f49b8196612d9e8ee"><code>6585d9c</code></a> PYTHON-2442: Refactor: use _asdict() in _options_dict() (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2670">#2670</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/fdb1f7ea4abe128ae4e59e3d063fd95d7daaa964"><code>fdb1f7e</code></a> PYTHON-5677 Prevent ClientEncryption from loading crypt shared library (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2659">#2659</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/0cd9763423b85cd37779ea934bf7b1f8be8bbf8e"><code>0cd9763</code></a> Bump zizmorcore/zizmor-action from cb3d8e846e148d1111d90b03375b9c03deceda37 t...</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/2f263d4d3f11eb4a2b32ace467fd2767c371f4d7"><code>2f263d4</code></a> PYTHON-5680 Fix handling of expectedDocuments in Unified Test Runner (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2665">#2665</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/e9658b2406232b6bd6ac1d961b368142f8819479"><code>e9658b2</code></a> Add 4.15.5 release date to changelog (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2666">#2666</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/10dd20405ba19c643a1b305ff84f742b19c40daf"><code>10dd204</code></a> Update coverage[toml] requirement from <=7.10.6,>=5 to >=5,<=7.10.7 (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2662">#2662</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/130067799cc671d4dcc2f34dafff73c4ef5ddeaf"><code>1300677</code></a> [Spec Resync] 12-22-2025 (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2663">#2663</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/18c1f142b5b3fd179a677b2736332dc17770b7c2"><code>18c1f14</code></a> PYTHON-5529 Introduce optin setting to await for MinPoolSize population (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2664">#2664</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mongodb/mongo-python-driver/compare/4.8.0...4.16.0">compare view</a></li> </ul> </details> <br /> You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: moonbox3 <[email protected]> |
||
|
dependabot[bot]andwestey
|
445fd0ea53 |
.Net: Bump Aspire.Azure.Search.Documents from 9.5.1 to 13.3.0 (#13994)
Updated [Aspire.Azure.Search.Documents](https://github.com/microsoft/aspire) from 9.5.1 to 13.3.0. <details> <summary>Release notes</summary> _Sourced from [Aspire.Azure.Search.Documents's releases](https://github.com/microsoft/aspire/releases)._ ## 13.3.0 # Aspire 13.3.0 Aspire 13.3 is here! 🚀 This release is packed with new ways to deploy, debug, and build distributed apps — including `aspire destroy`, browser telemetry in the dashboard, Kubernetes deployment, first-class JavaScript publishing, and major TypeScript AppHost parity improvements. ## Highlights - 🧹 **Clean teardown** — New **`aspire destroy`** tears down Azure, Kubernetes, and Docker Compose deployments, and pipeline summaries make deploy/publish/destroy runs easier to follow. - 🔍 **Frontend telemetry** — **Aspire.Hosting.Browsers** captures browser console logs, network requests, and screenshots right in the Aspire dashboard. - ☸️ **Kubernetes deploy preview** — **`aspire deploy`** can now generate Helm-based Kubernetes deployments, with first-class Ingress and Gateway API routing. - 🟨 **JavaScript publishing** — New **`PublishAs*`** methods support static sites, Node servers, npm-script apps, Next.js, Vite, Bun, Yarn, and pnpm. - 🌐 **TypeScript AppHost parity** — Unified `withEnvironment`, Docker Compose hooks, endpoint expressions, Azure Container Apps domains, and more close the gap with C# AppHosts. - 🛠️ **CLI upgrades** — Run the standalone dashboard with **`aspire dashboard run`**, install the CLI as a NativeAOT `dotnet tool`, and search API docs from the terminal. - ☁️ **Azure goodness** — New Azure Front Door, Network Security Perimeter, AKS, private endpoint, and Foundry Prompt Agent support. - 🐳 **Better containers** — The Aspire container tunnel is now enabled by default for consistent host connectivity across Docker Desktop, Docker Engine, and Podman. ## ⚠️ Breaking changes Notable breaking changes include `--log-level` becoming `--pipeline-log-level`, the dashboard MCP server being replaced by `aspire agent init`, `dotnet new aspire-py-starter` moving to `aspire new aspire-py-starter`, and several API shape updates across AKS, Foundry, JavaScript diagnostics, and TypeScript AppHost helpers. See the full list in the [Aspire 13.3 breaking changes](https://aspire.dev/whats-new/aspire-13-3/#%EF%B8%8F-breaking-changes). ## 📖 Learn more For the full details, examples, migration guidance, and everything new in this release, check out [What's new in Aspire 13.3](https://aspire.dev/whats-new/aspire-13-3/). Thank you to all the community contributors who helped make Aspire 13.3 possible! 💜 ## 13.2.4 # Aspire 13.2.4 ## What's New in Aspire 13.2.4 Patch release addressing a security advisory in OpenTelemetry dependencies. ### 🐛 Fixes - 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#16420) ### 🏷️ Housekeeping - 🚀 Bumped branding to 13.2.4 (#16436) ## 13.2.3 # What's New in Aspire 13.2.3 Patch release focused on CLI packaging, signing, and reliability fixes. ## 🐛 Fixes - 🛑 aspire stop now properly cleans up application containers on Windows (#16123) - 🔐 Fixed macOS signing, permissions, and certificate trust with improved CI verification (#16053) - ✍️ Fixed signing for the aspire-managed bundle payload (#16211) - 🎭 Fixed Playwright CLI provenance verification for the new tag format (#16134) - 🧭 Updated service discovery environment variables (#16223) ## 🔧 Improvements - 📊 Removed telemetry API data limits and refactored URL builders (#16023) - ⏱️ Increased native build + sign timeout to 60 minutes for reliability (#16212) ## 🏷️ Housekeeping - 🔖 Bumped branding to 13.2.3 (#16181) - 🧪 Temporarily disabled Verify CLI archive step on Windows while investigating (#16276, #16285) ## 13.2.2 This is a servicing release focused on bug fixes and platform improvements. 🐛 Bug Fixes - Fix SqlClient runtime asset layout on Unix — Resolved an issue where Microsoft.Data.SqlClient failed to load correctly on macOS and Linux due to incorrect NuGet asset layout (#15709) - Fix IDE execution regressions for Azure Functions and class library projects — Backported fixes for 13.2 regressions impacting IDE-based execution (#15714) - Fix NpmRunner multi-version output parsing — npm view returning multiple versions no longer breaks version resolution; also bumps @playwright/cli to >=0.1.3 (#15746) - Skip name validation for internal resources — ProjectRebuilderResource, installer, and venv creator resources no longer fail the 64-char name limit since they're never deployed (#15726, fixes #15693) 🔒 Security & Certificates - Use ASP.NET Core dev cert for DCP — Avoids ephemeral certificate trust issues by using the standard ASP.NET Core developer certificate (#15718) - Cache PFX dev certs on Windows and Linux — Prevents binary-level changes between runs for persistent container scenarios (#15774) 🏗️ Infrastructure & Platform - ARM64 CLI support — Added win-arm64 and linux-arm64 to the native CLI archive build matrix (#15599) - Update DCP to 0.22.11 (#15713) 💻 CLI Improvements - Show anonymous dashboard URLs in aspire ps — The dashboard URL is now displayed even when running without authentication (#15731 ## 13.2.1 🐛 Bug Fixes - 🖥️ CLI bundles for ARM & musl — win-arm64, linux-arm64, and linux-musl-x64 bundles now correctly include DCP instead of silently producing broken installs (#15529) - ⚡ aspire new in VS Code — Fixed a race where the workspace switch severed the CLI terminal before the agent init prompt could complete (#15553) - 🔗 Dashboard resource URLs — The describe command no longer produces broken dashboard links with a stray /login?t=... in the path (#15495) - 🌍 Guest AppHost env vars — Launch profile environment variables are now correctly forwarded to guest AppHosts (#15637) - 📦 Legacy settings migration — .aspire/settings.json → aspire.config.json migration was silently skipped in some scenarios; now works reliably (#15526) - 🔧 TypeScript AppHost restore — Fixed config resolution during TS AppHost restore (#15625) - 🎭 Playwright CLI on Windows — aspire agent init now correctly installs playwright-cli on Windows (#15559) - 📌 Emulator stability — Pinned Kusto emulator image and improved Cosmos DB emulator reliability (#15504) ✨ Improvements - 🏗️ Brownfield TypeScript aspire init — Running aspire init in existing JS/TS projects now smartly merges package.json — scripts, dependencies, and engines — with semver-aware conflict handling (#15123) - 🎯 Endpoint filtering — New ExcludeReferenceEndpoint property lets you filter specific endpoints from WithReference (#15586) - 🌐 More polyglot ATS APIs — Exported additional hosting APIs for TypeScript and Go AppHost authoring (#15557) - 🔍 Short trace ID support — The dashboard now resolves short trace IDs in addition to full-length ones (#15613) - ⚠️ Aspire.Hosting.NodeJs deprecated — Use Aspire.Hosting.JavaScript instead; the old package no longer appears in aspire add (#15686) ## 13.2.0 # Aspire 13.2 Aspire 13.2 brings major CLI enhancements, a new TypeScript AppHost (preview), dashboard data export/import, Microsoft Foundry integration, and multi-language improvements — all focused on making local development more streamlined for developers and AI coding agents alike. ## Highlights - 🛠️ CLI overhaul — New commands including **aspire start/stop/ps** for detached mode, **aspire describe** for resource monitoring, **aspire doctor** for environment diagnostics, **aspire secret** for managing user secrets, **aspire docs** for browsing documentation from the terminal, and **aspire agent** (renamed from **aspire mcp**) for AI agent integration. - 🌐 TypeScript AppHost (preview) — Write your apphost in TypeScript with **createBuilder()**, using the same app model concepts as C#. Full VS Code extension support included. - 🧩 VS Code extension — Dedicated Aspire Activity Bar panel with live resource state, inline CodeLens with health status and actions, gutter decorations, and a new Getting Started walkthrough. - 📊 Dashboard improvements — Bulk telemetry export/import, export environment variables as **.env** files, a new telemetry HTTP API, set parameters directly from the dashboard, and improved resource graph layout. - 🤖 Microsoft Foundry — Replaces Azure AI Foundry integration with broader **Aspire.Hosting.Foundry** support including hosted agents and model deployments. - 🔒 Azure Virtual Network & Private Endpoints — New **Aspire.Hosting.Azure.Network** integration for defining VNets, subnets, NAT gateways, NSGs, and private endpoints directly in your apphost. - 🐳 Docker Compose publishing — Generate docker-compose.yaml from your app model with **AddDockerComposeEnvironment.** - 📦 New integrations — Azure Data Lake Storage, MongoDB EF Core (**Aspire.MongoDB.EntityFrameworkCore**), Bun support for JS resources, and Certbot for automated SSL certificates. - ⚡ App model — **WithMcpServer** for declaring MCP endpoints, **rebuild** command for project resources, contextual endpoint resolution, and improved secret/certificate handling. ## ⚠️ Breaking changes Notable breaking changes include service discovery env vars now using endpoint scheme instead of name, aspire.config.json replacing split config files, AIFoundry → Foundry rename, WithSecretBuildArg → WithBuildSecret, and updated default Azure credential behavior. [See the full list of breaking changes](https://aspire.dev/whats-new/aspire-13-2/#%EF%B8%8F-breaking-changes). ## 📖 Learn more For the full details on everything in this release, check out the [What's new in Aspire 13.2](https://aspire.dev/whats-new/aspire-13-2/) documentation. Thank you to all the community contributors who helped make this release happen! 💜 ## 13.1.3 ## What's Changed * [release/13.1] Add installer publishing updates for 13.1.3 by @radical in https://github.com/dotnet/aspire/pull/15158 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.2...v13.1.3 ## 13.1.2 ## What's Changed * Bump patch version from 13.1.1 to 13.1.2 by @Copilot in https://github.com/dotnet/aspire/pull/14699 * [release/13.1] Fix template version parsing for .NET 10.0 SDK separator change by @JamesNK in https://github.com/dotnet/aspire/pull/14698 * Update pipeline images to non-deprecated pools by @joperezr in https://github.com/dotnet/aspire/pull/14707 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.1...v13.1.2 ## 13.1.1 ## What's Changed * [release/13.1] Ensure WithHostHttpsPort works when chained inline by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13678 * [release/13.1] Escape backslashes in path string to discovered vite config by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13822 * [release/13.1] [Testing] Fixing bugs for sticky slot app settings by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13810 * [release/13.1] Fix AzureBicepResource file-not-found error when using templateFile with AzurePublishingContext by @github-actions[bot] in https://github.com/dotnet/aspire/pull/14018 * [release/13.1] Filter dev certs without X509SubjectKeyIdentifierExtension when any cert has it by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13676 * [release/13.1] Fix Aspire.ProjectTemplates build failure from command line length limits by @github-actions[bot] in https://github.com/dotnet/aspire/pull/14009 * [release/13.1] Update Azure.Identity package version to 1.17.1 by @eerhardt in https://github.com/dotnet/aspire/pull/14251 * Bump patch version from 13.1.0 to 13.1.1 by @Copilot in https://github.com/dotnet/aspire/pull/14329 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.0...v13.1.1 ## 13.1.0 We are excited to share that our 13.1.0 release of Aspire has shipped! All of the packages are available in NuGet.org now. Head over to https://aspire.dev/whats-new/aspire-13-1/ to find what's new in 13.1.0! ## What's Changed * Target net10.0 in client integrations by @eerhardt in https://github.com/dotnet/aspire/pull/12500 * Fix DockerComposeEnvironment duplicating image names in .env file by @Copilot in https://github.com/dotnet/aspire/pull/12310 * Replace apt-get with npm for Azure Functions Core Tools installation by @Copilot in https://github.com/dotnet/aspire/pull/12537 * Improve flaky dashboard integration test by @JamesNK in https://github.com/dotnet/aspire/pull/12534 * Add README.md for the Aspire.Hosting.Azure.AppService package by @ShilpiRach in https://github.com/dotnet/aspire/pull/12528 * Add support to enable automatic scaling for App Service Environment by @ShilpiRach in https://github.com/dotnet/aspire/pull/12305 * Update to FluentUI 4.13.1 by @JamesNK in https://github.com/dotnet/aspire/pull/12532 * Skip playground projects in build-packages workflow by @Copilot in https://github.com/dotnet/aspire/pull/12547 * Allow HostUrl to remap both address and port by @danegsta in https://github.com/dotnet/aspire/pull/12521 * Refactor NodeJs Integration by @eerhardt in https://github.com/dotnet/aspire/pull/12530 * Fix MCP endpoint with redirect HTTPS by @JamesNK in https://github.com/dotnet/aspire/pull/12556 * [main] Update dependencies from microsoft/usvc-apiserver by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12540 * Refactor AddNodeApp by @eerhardt in https://github.com/dotnet/aspire/pull/12538 * Update Aspire branding from 13.0 to 13.1 by @Copilot in https://github.com/dotnet/aspire/pull/12527 * Add annotation to specify custom base images for generated Dockerfiles by @Copilot in https://github.com/dotnet/aspire/pull/12566 * Fix generating random MCP endpoint URL in templates by @JamesNK in https://github.com/dotnet/aspire/pull/12558 * [CI] Add new Agent for disabling or quarantining tests by @radical in https://github.com/dotnet/aspire/pull/12570 * Add `ExcludeFromMcp()` resource extension by @JamesNK in https://github.com/dotnet/aspire/pull/12515 * Localized file check-in by OneLocBuild Task: Build definition ID 1309: Build ID 2828818 by @dotnet-bot in https://github.com/dotnet/aspire/pull/12546 * Register IPipelineOutputService in DI for pipeline output directory management by @Copilot in https://github.com/dotnet/aspire/pull/12563 * Add deploy support for Docker Compose by @captainsafia in https://github.com/dotnet/aspire/pull/12548 * Quarantine flaky test: AzureServiceBusEmulatorResourceGeneratesConfigJsonWithCustomizations by @Copilot in https://github.com/dotnet/aspire/pull/12578 * Update connection properties for non-Azure resources by @sebastienros in https://github.com/dotnet/aspire/pull/12583 * Filter to highest package version per channel in aspire add command by @Copilot in https://github.com/dotnet/aspire/pull/12553 * Log DCP messages at Debug/Trace level in AppHost by @Copilot in https://github.com/dotnet/aspire/pull/12533 * Add CLI self-update prompts to `aspire update` command by @Copilot in https://github.com/dotnet/aspire/pull/12395 * Fix golang and alpine images. by @mitchdenny in https://github.com/dotnet/aspire/pull/12592 * Replace ContainerTargetPlatform.AllLinux with LinuxAmd64 by @Copilot in https://github.com/dotnet/aspire/pull/12596 * [main] Update dependencies from microsoft/usvc-apiserver by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12610 * Make IReportingStep and IReportingTask completion idempotent by @Copilot in https://github.com/dotnet/aspire/pull/12602 * Show --log-level debug hint when pipeline fails by @Copilot in https://github.com/dotnet/aspire/pull/12603 * [main] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12622 * Rename app.py to main.py in template by @eerhardt in https://github.com/dotnet/aspire/pull/12628 * bump extension version by @adamint in https://github.com/dotnet/aspire/pull/12623 * don't build apphost in cli when running in extension by @adamint in https://github.com/dotnet/aspire/pull/12621 * Detect which version of yarn is being used by @eerhardt in https://github.com/dotnet/aspire/pull/12633 * Fix duplicate key exception when using WithExplicitStart() on resources with environment callbacks by @Copilot in https://github.com/dotnet/aspire/pull/12604 * Support AddCSharpApp, fix some rough edges around project resources by @adamint in https://github.com/dotnet/aspire/pull/12568 * Add missing namespace to `CertificateAuthorityCollectionResource` by @danegsta in https://github.com/dotnet/aspire/pull/12639 * Add ModelContextProtocol assemblies to signing list by @joperezr in https://github.com/dotnet/aspire/pull/12637 * Generate fallback Dockerfile for Python apps without UV by @Copilot in https://github.com/dotnet/aspire/pull/12627 * Update/bump container image tags for hosting components by @joperezr in https://github.com/dotnet/aspire/pull/12459 * Mark IDeveloperCertificateService experimental by @danegsta in https://github.com/dotnet/aspire/pull/12648 * Wait with exponential backoff for expected Executables by @karolz-ms in https://github.com/dotnet/aspire/pull/12647 * Make ProcessCertificateTrustConfigAsync internal by @danegsta in https://github.com/dotnet/aspire/pull/12649 * Add test cases and ensure container cert override paths work by @danegsta in https://github.com/dotnet/aspire/pull/12654 * Python hosting: Support .venv lookup by walking up parent directories by @Copilot in https://github.com/dotnet/aspire/pull/12616 ... (truncated) ## 13.0.2 This patch is updating our Project Templates for our Python starter app to ensure we depend on the latest version of React. This is out of an abundance of caution, as we don't depend on any of the react packages that were flagged as vulnerable in https://github.com/advisories/GHSA-fv66-9v8q-g76r. ## What's Changed * Bump patch version from 13.0.1 to 13.0.2 by @Copilot in https://github.com/dotnet/aspire/pull/13324 * Update React and ReactDOM to version 19.2.1 across all projects by @joperezr in https://github.com/dotnet/aspire/pull/13325 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.0.1...v13.0.2 ## 13.0.1 ## What's Changed * Merge internal changes by @joperezr in https://github.com/dotnet/aspire/pull/12896 * [release/13.0] Fix Azure roles resources always redeploying by @github-actions[bot] in https://github.com/dotnet/aspire/pull/12903 * [release/13.0] Remove .py and .js files from being signed (#13005) by @eerhardt in https://github.com/dotnet/aspire/pull/13032 * [release/13.0] Fix subscription ID not being disabled on Azure provisioning dialog by @github-actions[bot] in https://github.com/dotnet/aspire/pull/12913 * [release/13.0] Default OpenAISettings.EnableSensitiveTelemetryData to TelemetryHelpers.EnableSensitiveDataDefault by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13017 * Bump patch version from 13.0.0 to 13.0.1 by @Copilot in https://github.com/dotnet/aspire/pull/13167 * [release/13.0] EndpointReference evaluation should wait on missing AllocatedEndpoint (#13074) by @karolz-ms in https://github.com/dotnet/aspire/pull/13076 * [release/13.0] Update to Npgsql 10 by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13166 * [release/13.0] Update dependencies from microsoft/usvc-apiserver by @danegsta in https://github.com/dotnet/aspire/pull/13187 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.0.0...v13.0.1 ## 13.0.0 We are excited to share that our 13.0.0 release of Aspire has shipped! All of the packages are available in NuGet.org now. Head over to https://aspire.dev/whats-new/aspire-13/ to find what's new in 13.0.0! ## New Contributors * @jomaxso made their first contribution in https://github.com/dotnet/aspire/pull/11840 * @jguadagno made their first contribution in https://github.com/dotnet/aspire/pull/11876 * @foxminchan made their first contribution in https://github.com/dotnet/aspire/pull/11700 * @yreynhout made their first contribution in https://github.com/dotnet/aspire/pull/12087 **Full Changelog**: https://github.com/dotnet/aspire/compare/v9.5.0...v13.0.0 ## 9.5.2 ## What's Changed * [release/9.5] Revert SQL Server container image tag from 2025-latest to 2022-latest for Mac ARM compatibility by @github-actions[bot] in https://github.com/dotnet/aspire/pull/11908 * [release/9.5] Ensure OutputPath is created in ResourceContainerImageBuilder by @github-actions[bot] in https://github.com/dotnet/aspire/pull/11886 * [release/9.5] Add configuration to suppress unsecured telemetry message in dashboard by @github-actions[bot] in https://github.com/dotnet/aspire/pull/11954 * [release/9.5] Update dependencies from https://github.com/microsoft/usvc-apiserver build 0.17.3 by @danegsta in https://github.com/dotnet/aspire/pull/12032 * [release/9.5] Multi-target RabbitMQ and Redis client libraries by @eerhardt in https://github.com/dotnet/aspire/pull/12138 * Backport PR #11951: Add noProfileSwitch to run command in DotNetCliRunner by @Copilot in https://github.com/dotnet/aspire/pull/11959 * Bump patch version to 9.5.2 by @Copilot in https://github.com/dotnet/aspire/pull/12139 **Full Changelog**: https://github.com/dotnet/aspire/compare/v9.5.1...v9.5.2 Commits viewable in [compare view](https://github.com/microsoft/aspire/compare/v9.5.1...v13.3.0). </details> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: westey <[email protected]> |
||
|
dependabot[bot]
|
367c75f4ff |
.Net: Bump minimatch from 3.1.2 to 3.1.5 in /dotnet/samples/Demos/ProcessWithCloudEvents/ProcessWithCloudEvents.Client (#13604)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.2 to 3.1.5. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/isaacs/minimatch/commit/7bba97888a27a6162983056bcce2a6e28f668712"><code>7bba978</code></a> 3.1.5</li> <li><a href="https://github.com/isaacs/minimatch/commit/bd259425b2ca17b42897997f93e890314155522d"><code>bd25942</code></a> docs: add warning about ReDoS</li> <li><a href="https://github.com/isaacs/minimatch/commit/1a9c27c75725474dbde57db2995b6281b267756d"><code>1a9c27c</code></a> fix partial matching of globstar patterns</li> <li><a href="https://github.com/isaacs/minimatch/commit/1a2e084af579731af66c221214e3ca8222c9bf23"><code>1a2e084</code></a> 3.1.4</li> <li><a href="https://github.com/isaacs/minimatch/commit/ae24656237c3d58067442f790ce17eff84463a47"><code>ae24656</code></a> update lockfile</li> <li><a href="https://github.com/isaacs/minimatch/commit/b1003749228b2a79e1f237963a0d559ef7a0941e"><code>b100374</code></a> limit recursion for **, improve perf considerably</li> <li><a href="https://github.com/isaacs/minimatch/commit/26ffeaa091b9f660833e23f42e07165b33e85c13"><code>26ffeaa</code></a> lockfile update</li> <li><a href="https://github.com/isaacs/minimatch/commit/9eca892a4e5dbb20534f9f30483b85cdeee6c2eb"><code>9eca892</code></a> lock node version to 14</li> <li><a href="https://github.com/isaacs/minimatch/commit/00c323b188b704e5d4bc534ecec2268cfa70a32a"><code>00c323b</code></a> 3.1.3</li> <li><a href="https://github.com/isaacs/minimatch/commit/30486b2048929264f44d18822891cfffa02af78b"><code>30486b2</code></a> update CI matrix and actions</li> <li>Additional commits viewable in <a href="https://github.com/isaacs/minimatch/compare/v3.1.2...v3.1.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]andcopilot-swe-agent[bot]
|
356aed0986 |
Python: Bump starlette from 0.52.1 to 1.3.1 in /python (#14092)
Bumps [starlette](https://github.com/Kludex/starlette) from 0.52.1 to 1.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p> <blockquote> <h2>Version 1.3.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>StarletteDeprecationWarning</code> instead of <code>DeprecationWarning</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3119">Kludex/starlette#3119</a></li> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3329">Kludex/starlette#3329</a></li> <li>Enforce <code>FormParser</code> limits in parser callbacks by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3331">Kludex/starlette#3331</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.3.0...1.3.1">https://github.com/Kludex/starlette/compare/1.3.0...1.3.1</a></p> <h2>Version 1.3.0</h2> <h2>What's Changed</h2> <ul> <li>Clamp oversized suffix ranges in <code>FileResponse</code> by <a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files by <a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li>Add <code>httpx2</code> to the <code>full</code> extra by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3323">Kludex/starlette#3323</a></li> <li>Adjust testclient typing and warnings by <a href="https://github.com/waketzheng"><code>@waketzheng</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3322">Kludex/starlette#3322</a></li> <li>Fix IndexError in URL.replace() on a URL with no authority by <a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li>Annotate URLPath protocol parameter with Literal by <a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li>avoid collapsing exception groups from user code by <a href="https://github.com/graingert"><code>@graingert</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/2830">Kludex/starlette#2830</a></li> <li>Use <code>removeprefix</code> to strip weak ETag indicator in <code>is_not_modified</code> by <a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> <li>Build <code>request.url</code> from structured components by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3326">Kludex/starlette#3326</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li><a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li><a href="https://github.com/leestana01"><code>@leestana01</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3319">Kludex/starlette#3319</a></li> <li><a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li><a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3204">Kludex/starlette#3204</a></li> <li><a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li><a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.1...1.3.0">https://github.com/Kludex/starlette/compare/1.2.1...1.3.0</a></p> <h2>Version 1.2.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module by <a href="https://github.com/leifwar"><code>@leifwar</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li>Add assert error for requires() when request param is not Request type by <a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/leifwar"><code>@leifwar</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li><a href="https://github.com/diskeu"><code>@diskeu</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3243">Kludex/starlette#3243</a></li> <li><a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.0...1.2.1">https://github.com/Kludex/starlette/compare/1.2.0...1.2.1</a></p> <h2>Version 1.2.0</h2> <h2>What's Changed</h2> <ul> <li>Support httpx2 in the test client by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3291">Kludex/starlette#3291</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.1.0...1.2.0">https://github.com/Kludex/starlette/compare/1.1.0...1.2.0</a></p> <h2>Version 1.1.0</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p> <blockquote> <h2>1.3.1 (June 12, 2026)</h2> <h4>Fixed</h4> <ul> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> <a href="https://redirect.github.com/encode/starlette/pull/3329">#3329</a>.</li> <li>Enforce <code>FormParser</code> limits in parser callbacks <a href="https://redirect.github.com/encode/starlette/pull/3331">#3331</a>.</li> </ul> <h2>1.3.0 (June 11, 2026)</h2> <h4>Added</h4> <ul> <li>Add <code>httpx2</code> to the <code>full</code> extra <a href="https://redirect.github.com/encode/starlette/pull/3323">#3323</a>.</li> <li>Annotate the <code>URLPath</code> <code>protocol</code> parameter with <code>Literal</code> <a href="https://redirect.github.com/encode/starlette/pull/3285">#3285</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Build <code>request.url</code> from structured components <a href="https://redirect.github.com/encode/starlette/pull/3326">#3326</a>.</li> <li>Clamp oversized suffix ranges in <code>FileResponse</code> <a href="https://redirect.github.com/encode/starlette/pull/3307">#3307</a>.</li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files <a href="https://redirect.github.com/encode/starlette/pull/3191">#3191</a>.</li> <li>Avoid collapsing exception groups raised from user code <a href="https://redirect.github.com/encode/starlette/pull/2830">#2830</a>.</li> <li>Use <code>removeprefix</code> to strip the weak <code>ETag</code> indicator in <code>is_not_modified</code> <a href="https://redirect.github.com/encode/starlette/pull/3193">#3193</a>.</li> <li>Fix <code>IndexError</code> in <code>URL.replace()</code> on a URL with no authority <a href="https://redirect.github.com/encode/starlette/pull/3317">#3317</a>.</li> <li>Adjust <code>testclient</code> typing and warnings <a href="https://redirect.github.com/encode/starlette/pull/3322">#3322</a>.</li> </ul> <h2>1.2.1 (May 31, 2026)</h2> <h4>Fixed</h4> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module <a href="https://redirect.github.com/encode/starlette/pull/3304">#3304</a>.</li> <li>Add assert error for <code>requires()</code> when the request parameter is not a <code>Request</code> type <a href="https://redirect.github.com/encode/starlette/pull/3298">#3298</a>.</li> </ul> <h2>1.2.0 (May 28, 2026)</h2> <h4>Added</h4> <ul> <li>Support httpx2 in the test client <a href="https://redirect.github.com/encode/starlette/pull/3291">#3291</a>.</li> </ul> <h2>1.1.0 (May 23, 2026)</h2> <h4>Added</h4> <ul> <li>Use <code>"application/octet-stream"</code> as the <code>FileResponse</code> media type fallback <a href="https://redirect.github.com/encode/starlette/pull/3283">#3283</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Only dispatch standard HTTP verbs in <code>HTTPEndpoint</code> <a href="https://redirect.github.com/encode/starlette/pull/3286">#3286</a>.</li> <li>Reject absolute paths in <code>StaticFiles.lookup_path</code> <a href="https://redirect.github.com/encode/starlette/pull/3287">#3287</a>.</li> </ul> <h2>1.0.1 (May 21, 2026)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Kludex/starlette/commit/8ebffd0678570ddd5d5bb11c6f3c3c7fd4682ab9"><code>8ebffd0</code></a> Version 1.3.1 (<a href="https://redirect.github.com/Kludex/starlette/issues/3330">#3330</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/25b8e179d8d7ed86769c02f648772dd5fb43dc3c"><code>25b8e17</code></a> Enforce <code>FormParser</code> limits in parser callbacks (<a href="https://redirect.github.com/Kludex/starlette/issues/3331">#3331</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/dba1c4babc4f99ad2622bb913d87045775dda735"><code>dba1c4b</code></a> Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3329">#3329</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/45e51dcf99f3a270b0bcec1aec5410b4345863a9"><code>45e51dc</code></a> Use <code>StarletteDeprecationWarning</code> instead of <code>DeprecationWarning</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3119">#3119</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/5f8610c386e13de1d80d36efa961e1486a1d2d01"><code>5f8610c</code></a> Version 1.3.0 (<a href="https://redirect.github.com/Kludex/starlette/issues/3327">#3327</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/167b5850e809f38b27fbfed62d58bf6442855975"><code>167b585</code></a> Build <code>request.url</code> from structured components (<a href="https://redirect.github.com/Kludex/starlette/issues/3326">#3326</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/37309255b4c1b9c381a2d24a1eaf83100984a16a"><code>3730925</code></a> Use <code>removeprefix</code> to strip weak ETag indicator in <code>is_not_modified</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3193">#3193</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/e6f7ad1ab85efb27ab7910d8007b3f4531f7b083"><code>e6f7ad1</code></a> avoid collapsing exception groups from user code (<a href="https://redirect.github.com/Kludex/starlette/issues/2830">#2830</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/115228fcdca0e0ef5bf4a95a40ddce5a9fced428"><code>115228f</code></a> Annotate URLPath protocol parameter with Literal (<a href="https://redirect.github.com/Kludex/starlette/issues/3285">#3285</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/113f193a34353c9153857028c1074351d22fad07"><code>113f193</code></a> docs: replace inline ASGI server list with link to canonical implemen… (<a href="https://redirect.github.com/Kludex/starlette/issues/3204">#3204</a>)</li> <li>Additional commits viewable in <a href="https://github.com/Kludex/starlette/compare/0.52.1...1.3.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> |
||
|
dependabot[bot]
|
6209c77fd5 |
.Net: Bump @babel/core from 7.26.10 to 7.29.7 in /dotnet/samples/Demos/ProcessWithCloudEvents/ProcessWithCloudEvents.Client (#14083)
Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.26.10 to 7.29.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/babel/babel/releases">@babel/core's releases</a>.</em></p> <blockquote> <h2>v7.29.7 (2026-05-25)</h2> <p>Re-release all packages with npm provenance attestations</p> <h2>v7.29.6 (2026-05-25)</h2> <h4>🐛 Bug Fix</h4> <ul> <li><code>babel-generator</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/18014">#18014</a> Catchup source map position in preserveFormat (<a href="https://github.com/nicolo-ribaudo"><code>@nicolo-ribaudo</code></a>)</li> </ul> </li> <li><code>babel-core</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/18001">#18001</a> [7.x packport]Improve input source map handling (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> <li><code>babel-core</code>, <code>babel-generator</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17998">#17998</a> Preserve original identifier names from input sourcemaps (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/17992">#17992</a>) (<a href="https://github.com/Andarist"><code>@Andarist</code></a>)</li> </ul> </li> </ul> <h4>Committers: 3</h4> <ul> <li>Huáng Jùnliàng (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> <li>Mateusz Burzyński (<a href="https://github.com/Andarist"><code>@Andarist</code></a>)</li> <li>Nicolò Ribaudo (<a href="https://github.com/nicolo-ribaudo"><code>@nicolo-ribaudo</code></a>)</li> </ul> <h2>v7.29.5 (2026-05-05)</h2> <h4>🏠 Internal</h4> <ul> <li><code>babel-preset-env</code> <ul> <li>Update <code>@babel/*</code> dependencies</li> </ul> </li> </ul> <h2>v7.29.4 (2026-05-05)</h2> <h4>🐛 Bug Fix</h4> <ul> <li><code>babel-plugin-transform-modules-systemjs</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17974">#17974</a> [7.x backport]fix(systemjs): improve module string name support (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> </ul> <h4>Committers: 1</h4> <ul> <li>Huáng Jùnliàng (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> <h2>v7.29.3 (2026-04-30)</h2> <h4>👓 Spec Compliance</h4> <ul> <li><code>babel-parser</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17923">#17923</a> Support flow extends bound (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> </ul> <h4>🐛 Bug Fix</h4> <ul> <li><code>babel-helper-create-class-features-plugin</code>, <code>babel-plugin-proposal-decorators</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17931">#17931</a> fix(decorators): replace super within all removed static elements (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> <li><code>babel-register</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17915">#17915</a> Fix thread synchronization issues in <code>@babel/register</code> (<a href="https://github.com/liuxingbaoyu"><code>@liuxingbaoyu</code></a>)</li> </ul> </li> <li><code>babel-compat-data</code>, <code>babel-plugin-bugfix-safari-rest-destructuring-rhs-array</code>, <code>babel-preset-env</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17788">#17788</a> Add bugfix plugin for Safari array rest destructuring bug (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> </ul> <h4>💅 Polish</h4> <ul> <li><code>babel-parser</code></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/babel/babel/commit/4fba7541180bf5f58256d8e358b544e3831ad090"><code>4fba754</code></a> v7.29.7</li> <li><a href="https://github.com/babel/babel/commit/04ea6b27fdac8f40c3481aec2080ac9678779509"><code>04ea6b2</code></a> v7.29.6</li> <li><a href="https://github.com/babel/babel/commit/99f498a9b9fa0b900d603fbe8f6601bb3b9e42bb"><code>99f498a</code></a> [7.x packport]Improve input source map handling (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/18001">#18001</a>)</li> <li><a href="https://github.com/babel/babel/commit/feba0a3654c596bd369d1ef1231f5d56666d56dc"><code>feba0a3</code></a> Preserve original identifier names from input sourcemaps (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/17992">#17992</a>) (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/17998">#17998</a>)</li> <li><a href="https://github.com/babel/babel/commit/aa8394e454337d118ac3d40bfa3ee1a3cb3f3ed2"><code>aa8394e</code></a> v7.29.0</li> <li><a href="https://github.com/babel/babel/commit/ad0d03f0c92404a60ec6b1c12f15febd38e2397a"><code>ad0d03f</code></a> [7.x backport] feat: Allow specifying startLine in code frame (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/17739">#17739</a>)</li> <li><a href="https://github.com/babel/babel/commit/d7f400889567ae18ef9ac41b024b5120f6060e17"><code>d7f4008</code></a> v7.28.6</li> <li><a href="https://github.com/babel/babel/commit/e130225028e93e106135586f344cfa44c4aac847"><code>e130225</code></a> Polish(standalone): improve message on invalid preset/plugin (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/17606">#17606</a>)</li> <li><a href="https://github.com/babel/babel/commit/99dcba5e71de3bd81ce14077cfa5b6df58e9b177"><code>99dcba5</code></a> chore: enable some ts-eslint rules (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/17592">#17592</a>)</li> <li><a href="https://github.com/babel/babel/commit/c92c4919771105140015167f25f7bacac77c90d9"><code>c92c491</code></a> Improve Unicode handling in code-frame tokenizer (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/17589">#17589</a>)</li> <li>Additional commits viewable in <a href="https://github.com/babel/babel/commits/v7.29.7/packages/babel-core">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@babel/core</code> since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
51748eecf3 |
Python: Bump pyjwt from 2.11.0 to 2.13.0 in /python (#14084)
Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.11.0 to 2.13.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.13.0</h2> <h1>PyJWT 2.13.0 — Security Release</h1> <p>This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.</p> <h2>Security</h2> <ul> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"><code>GHSA-xgmm-8j9v-c9wx</code></a> — JWK JSON accepted as HMAC secret (algorithm confusion).</strong> <code>HMACAlgorithm.prepare_key</code> previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in <code>algorithms=[…]</code> and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. <em>Reported by <a href="https://github.com/aradona91"><code>@aradona91</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f"><code>GHSA-jq35-7prp-9v3f</code></a> — Algorithm allow-list bypass with <code>PyJWK</code> / <code>PyJWKClient</code>.</strong> When verifying with a <code>PyJWK</code>, the caller's <code>algorithms=[…]</code> allow-list was checked against the token header <code>alg</code> as a string only; actual verification used the algorithm bound to the <code>PyJWK</code>. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header <code>alg</code> to match the <code>PyJWK</code>'s algorithm before verification. <em>Reported by <a href="https://github.com/sushi-gif"><code>@sushi-gif</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39"><code>GHSA-w7vc-732c-9m39</code></a> — DoS via base64 decode of unused payload segment when <code>b64=false</code>.</strong> For detached-payload JWS (<code>b64=false</code>), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied <code>detached_payload</code>. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. <em>Reported by <a href="https://github.com/thesmartshadow"><code>@thesmartshadow</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4"><code>GHSA-993g-76c3-p5m4</code></a> — <code>PyJWKClient</code> accepts non-HTTP(S) URIs.</strong> <code>PyJWKClient.fetch_data</code> passed its URI to <code>urllib.request.urlopen</code>, which by default also handles <code>file://</code>, <code>ftp://</code>, and <code>data:</code> schemes. An application that fed an attacker-influenced URI into <code>PyJWKClient</code> could be coerced into reading local files or reaching other unintended schemes. <code>PyJWKClient</code> now rejects any URI whose scheme isn't <code>http</code> or <code>https</code>. <em>Reported by <a href="https://github.com/KEIJOT"><code>@KEIJOT</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8"><code>GHSA-fhv5-28vv-h8m8</code></a> — <code>PyJWKClient</code> cache wiped on fetch error.</strong> A <code>finally</code>-block <code>put(jwk_set=None)</code> cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. <em>Reported by <a href="https://github.com/eddieran"><code>@eddieran</code></a>.</em></p> </li> </ul> <h2>Fixed</h2> <ul> <li>Reject empty HMAC keys outright in <code>HMACAlgorithm.prepare_key</code> with <code>InvalidKeyError</code> instead of accepting them with only a warning. Defends against the <code>os.getenv("JWT_SECRET", "")</code> footgun. <em>Thanks to <a href="https://github.com/SnailSploit"><code>@SnailSploit</code></a> and <a href="https://github.com/spartan8806"><code>@spartan8806</code></a> for the reports.</em></li> <li>Forward per-call <code>options</code> (including <code>enforce_minimum_key_length</code>) from <code>PyJWT.decode</code> through to <code>PyJWS._verify_signature</code>. The option was previously silently dropped between the two layers, so it only took effect when set on the <code>PyJWT</code> instance. <em>Thanks to <a href="https://github.com/WLUB"><code>@WLUB</code></a> for the report.</em></li> <li><strong>RFC 7797 §3 compliance for <code>b64=false</code>:</strong> the encoder now auto-adds <code>"b64"</code> to <code>crit</code>, and the decoder rejects tokens that set <code>b64=false</code> without listing it in <code>crit</code>. <em>Thanks to <a href="https://github.com/MachineLearning-Nerd"><code>@MachineLearning-Nerd</code></a> for the report.</em></li> </ul> <h2>Changed</h2> <ul> <li>Migrate the <code>dev</code>, <code>docs</code>, and <code>tests</code> package extras to dependency groups, by <a href="https://github.com/kurtmckee"><code>@kurtmckee</code></a> in <a href="https://redirect.github.com/jpadilla/pyjwt/pull/1152">#1152</a>.</li> </ul> <h2>Upgrade notes</h2> <p>Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:</p> <ul> <li><strong>Empty HMAC keys now raise.</strong> If your app passed <code>""</code> or <code>b""</code> as a secret (often via a missing env var, e.g. <code>os.getenv("JWT_SECRET", "")</code>), <code>encode</code>/<code>decode</code> will now raise <code>InvalidKeyError</code>. This is the intended behavior — fix the configuration.</li> <li><strong><code>PyJWK</code> decoding now requires the token's <code>alg</code> to match the JWK's algorithm.</strong> Previously a mismatch was silently honored if the header <code>alg</code> appeared in the allow-list. Tokens that relied on this mismatch will now fail with <code>InvalidAlgorithmError</code>.</li> <li><strong><code>PyJWKClient</code> now rejects non-HTTP(S) URIs at construction time.</strong> Tests or dev environments that fetched JWKS from <code>file://</code> URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct <code>PyJWKSet.from_dict(...)</code> directly).</li> <li><strong><code>b64=false</code> tokens are now strictly RFC 7515 / 7797 compliant.</strong> Tokens with a non-empty compact-form payload segment, or that omit <code>"b64"</code> from <code>crit</code>, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.</li> <li><strong><code>enforce_minimum_key_length</code> set per-call now takes effect.</strong> Callers who passed <code>options={"enforce_minimum_key_length": True}</code> to <code>jwt.decode()</code> previously got no enforcement; they will now get <code>InvalidKeyError</code> on undersized keys, as documented.</li> </ul> <p><strong>Full changelog:</strong> <a href="https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0">https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0</a></p> <h2>2.12.1</h2> <h2>What's Changed</h2> <ul> <li>Add typing_extensions dependency for Python < 3.11 by <a href="https://github.com/jpadilla"><code>@jpadilla</code></a> in <a href="https://redirect.github.com/jpadilla/pyjwt/pull/1151">jpadilla/pyjwt#1151</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1">https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1</a></p> <h2>2.12.0</h2> <h2>Security</h2> <ul> <li>Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by <a href="https://github.com/dmbs335"><code>@dmbs335</code></a> in <a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f">GHSA-752w-5fwx-jx9f</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0></code>__</h2> <p>Security</p> <pre><code> - Reject JWK JSON documents passed as raw HMAC secrets in ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that the existing PEM/SSH guard did not cover. Reported by @aradona91 in `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__. - Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during verification so the caller's ``algorithms=[...]`` allow-list cannot be bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__. - Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker- influenced URIs cannot read local files or reach unintended schemes via urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__. - Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``. The previous ``finally``-block ``put(None)`` pattern cleared the cache on any transient outage, turning one bad JWKS request into application- wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__. - Skip the unconditional base64 decode of the compact-form payload segment when ``b64=false`` is set in the protected header, and require that segment to be empty (RFC 7515 Appendix F detached form). Closes an unauthenticated DoS amplifier. Reported by @thesmartshadow in `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__. <p>Fixed</p> <pre><code> - Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with ``InvalidKeyError`` instead of accepting them with only a warning. Thanks to @SnailSploit and @spartan8806 for independently flagging the footgun. - Forward per-call ``options`` (including ``enforce_minimum_key_length``) from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the option actually takes effect when set at the call site rather than only on the ``PyJWT`` instance. Thanks to @WLUB for the report. - RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds ``&quot;b64&quot;`` to the ``crit`` header parameter, and the decoder rejects tokens that set ``b64=false`` without listing it in ``crit``. Thanks to @MachineLearning-Nerd for the report. Changed </code></pre> <ul> <li>Migrate the <code>dev</code>, <code>docs</code>, and <code>tests</code> package extras to dependency groups by <a href="https://github.com/kurtmckee"><code>@kurtmckee</code></a> in <code>[#1152](https://github.com/jpadilla/pyjwt/issues/1152) &lt;https://github.com/jpadilla/pyjwt/pull/1152&gt;</code>__</li> </ul> <p><code>v2.12.1 &lt;https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1&gt;</code>__ </tr></table> </code></pre></p> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jpadilla/pyjwt/commit/7144e4534c34810f4525dc4578a32addd8212cff"><code>7144e45</code></a> Apply ruff format</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/d2f4bec4963897c0ef96ef64a875894f2c8542ab"><code>d2f4bec</code></a> Restore <code>cast()</code> calls with cross-version <code>type: ignore</code> for <code>prepare_key</code></li> <li><a href="https://github.com/jpadilla/pyjwt/commit/22f478cebddd8294259c30f037ecb92b0b348774"><code>22f478c</code></a> Remove redundant casts in <code>RSAAlgorithm.prepare_key</code> and `ECAlgorithm.prepare...</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81"><code>95791b1</code></a> Bundle security fixes and hardening into 2.13.0</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/dcc27a9d3182a2349c30b160758785c6ce7a6508"><code>dcc27a9</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1155">#1155</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/9d08a9a1896845ed8eaf88e6f6ac61e5800c3e7a"><code>9d08a9a</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1146">#1146</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/b87c10014d4109f0214fea188d00faaaf8a80e64"><code>b87c100</code></a> Bump codecov/codecov-action from 5 to 6 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1154">#1154</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/40e3147eb5f790d8d041772e5fc00728a176c812"><code>40e3147</code></a> Migrate development extras to dependency groups (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1152">#1152</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/a4e1a3d1218b01c5806420b8f16d9308ac4adc30"><code>a4e1a3d</code></a> Add typing_extensions dependency for Python < 3.11 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1151">#1151</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/bd9700cca7f9258fadcc429c1034e508025931f2"><code>bd9700c</code></a> Use PyJWK algorithm when encoding without explicit algorithm (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1148">#1148</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.11.0...2.13.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]andcopilot-swe-agent[bot]
|
614db62500 |
Python: Bump tornado from 6.5.5 to 6.5.7 in /python (#14090)
Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.7. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst">tornado's changelog</a>.</em></p> <blockquote> <h1>Release notes</h1> <p>.. toctree:: :maxdepth: 2</p> <p>releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2 releases/v3.2.1</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4"><code>48fc2d4</code></a> Merge pull request <a href="https://redirect.github.com/tornadoweb/tornado/issues/3633">#3633</a> from bdarnell/curl-reset-65</li> <li><a href="https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841"><code>4ae1ddd</code></a> Release notes and version bump for 6.5.7</li> <li><a href="https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43"><code>3154caa</code></a> curl_httpclient: Reset the curl object before putting it on the freelist</li> <li><a href="https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2"><code>7d869c0</code></a> Merge pull request <a href="https://redirect.github.com/tornadoweb/tornado/issues/3631">#3631</a> from bdarnell/cve-links</li> <li><a href="https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3"><code>288241f</code></a> docs: Use the correct link syntax</li> <li><a href="https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6"><code>8da981c</code></a> docs: Add CVE links to 6.5.6 release notes</li> <li><a href="https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751"><code>aba2569</code></a> Merge pull request <a href="https://redirect.github.com/tornadoweb/tornado/issues/3626">#3626</a> from bdarnell/fixes-656</li> <li><a href="https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09"><code>a24b260</code></a> httpclient_test: Accept an additional error message variant</li> <li><a href="https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24"><code>a74240a</code></a> Release notes and version bump for 6.5.6.</li> <li><a href="https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5"><code>e8fc7ed</code></a> simple_httpclient: Strip auth headers on cross-origin redirects</li> <li>Additional commits viewable in <a href="https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> |
||
|
dependabot[bot]
|
1ad0b7501b |
Bump Aspire.Hosting.AppHost from 13.0.0 to 13.3.0 (#13995)
Updated [Aspire.Hosting.AppHost](https://github.com/microsoft/aspire) from 13.0.0 to 13.3.0. <details> <summary>Release notes</summary> _Sourced from [Aspire.Hosting.AppHost's releases](https://github.com/microsoft/aspire/releases)._ ## 13.3.0 # Aspire 13.3.0 Aspire 13.3 is here! 🚀 This release is packed with new ways to deploy, debug, and build distributed apps — including `aspire destroy`, browser telemetry in the dashboard, Kubernetes deployment, first-class JavaScript publishing, and major TypeScript AppHost parity improvements. ## Highlights - 🧹 **Clean teardown** — New **`aspire destroy`** tears down Azure, Kubernetes, and Docker Compose deployments, and pipeline summaries make deploy/publish/destroy runs easier to follow. - 🔍 **Frontend telemetry** — **Aspire.Hosting.Browsers** captures browser console logs, network requests, and screenshots right in the Aspire dashboard. - ☸️ **Kubernetes deploy preview** — **`aspire deploy`** can now generate Helm-based Kubernetes deployments, with first-class Ingress and Gateway API routing. - 🟨 **JavaScript publishing** — New **`PublishAs*`** methods support static sites, Node servers, npm-script apps, Next.js, Vite, Bun, Yarn, and pnpm. - 🌐 **TypeScript AppHost parity** — Unified `withEnvironment`, Docker Compose hooks, endpoint expressions, Azure Container Apps domains, and more close the gap with C# AppHosts. - 🛠️ **CLI upgrades** — Run the standalone dashboard with **`aspire dashboard run`**, install the CLI as a NativeAOT `dotnet tool`, and search API docs from the terminal. - ☁️ **Azure goodness** — New Azure Front Door, Network Security Perimeter, AKS, private endpoint, and Foundry Prompt Agent support. - 🐳 **Better containers** — The Aspire container tunnel is now enabled by default for consistent host connectivity across Docker Desktop, Docker Engine, and Podman. ## ⚠️ Breaking changes Notable breaking changes include `--log-level` becoming `--pipeline-log-level`, the dashboard MCP server being replaced by `aspire agent init`, `dotnet new aspire-py-starter` moving to `aspire new aspire-py-starter`, and several API shape updates across AKS, Foundry, JavaScript diagnostics, and TypeScript AppHost helpers. See the full list in the [Aspire 13.3 breaking changes](https://aspire.dev/whats-new/aspire-13-3/#%EF%B8%8F-breaking-changes). ## 📖 Learn more For the full details, examples, migration guidance, and everything new in this release, check out [What's new in Aspire 13.3](https://aspire.dev/whats-new/aspire-13-3/). Thank you to all the community contributors who helped make Aspire 13.3 possible! 💜 ## 13.2.4 # Aspire 13.2.4 ## What's New in Aspire 13.2.4 Patch release addressing a security advisory in OpenTelemetry dependencies. ### 🐛 Fixes - 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#16420) ### 🏷️ Housekeeping - 🚀 Bumped branding to 13.2.4 (#16436) ## 13.2.3 # What's New in Aspire 13.2.3 Patch release focused on CLI packaging, signing, and reliability fixes. ## 🐛 Fixes - 🛑 aspire stop now properly cleans up application containers on Windows (#16123) - 🔐 Fixed macOS signing, permissions, and certificate trust with improved CI verification (#16053) - ✍️ Fixed signing for the aspire-managed bundle payload (#16211) - 🎭 Fixed Playwright CLI provenance verification for the new tag format (#16134) - 🧭 Updated service discovery environment variables (#16223) ## 🔧 Improvements - 📊 Removed telemetry API data limits and refactored URL builders (#16023) - ⏱️ Increased native build + sign timeout to 60 minutes for reliability (#16212) ## 🏷️ Housekeeping - 🔖 Bumped branding to 13.2.3 (#16181) - 🧪 Temporarily disabled Verify CLI archive step on Windows while investigating (#16276, #16285) ## 13.2.2 This is a servicing release focused on bug fixes and platform improvements. 🐛 Bug Fixes - Fix SqlClient runtime asset layout on Unix — Resolved an issue where Microsoft.Data.SqlClient failed to load correctly on macOS and Linux due to incorrect NuGet asset layout (#15709) - Fix IDE execution regressions for Azure Functions and class library projects — Backported fixes for 13.2 regressions impacting IDE-based execution (#15714) - Fix NpmRunner multi-version output parsing — npm view returning multiple versions no longer breaks version resolution; also bumps @playwright/cli to >=0.1.3 (#15746) - Skip name validation for internal resources — ProjectRebuilderResource, installer, and venv creator resources no longer fail the 64-char name limit since they're never deployed (#15726, fixes #15693) 🔒 Security & Certificates - Use ASP.NET Core dev cert for DCP — Avoids ephemeral certificate trust issues by using the standard ASP.NET Core developer certificate (#15718) - Cache PFX dev certs on Windows and Linux — Prevents binary-level changes between runs for persistent container scenarios (#15774) 🏗️ Infrastructure & Platform - ARM64 CLI support — Added win-arm64 and linux-arm64 to the native CLI archive build matrix (#15599) - Update DCP to 0.22.11 (#15713) 💻 CLI Improvements - Show anonymous dashboard URLs in aspire ps — The dashboard URL is now displayed even when running without authentication (#15731 ## 13.2.1 🐛 Bug Fixes - 🖥️ CLI bundles for ARM & musl — win-arm64, linux-arm64, and linux-musl-x64 bundles now correctly include DCP instead of silently producing broken installs (#15529) - ⚡ aspire new in VS Code — Fixed a race where the workspace switch severed the CLI terminal before the agent init prompt could complete (#15553) - 🔗 Dashboard resource URLs — The describe command no longer produces broken dashboard links with a stray /login?t=... in the path (#15495) - 🌍 Guest AppHost env vars — Launch profile environment variables are now correctly forwarded to guest AppHosts (#15637) - 📦 Legacy settings migration — .aspire/settings.json → aspire.config.json migration was silently skipped in some scenarios; now works reliably (#15526) - 🔧 TypeScript AppHost restore — Fixed config resolution during TS AppHost restore (#15625) - 🎭 Playwright CLI on Windows — aspire agent init now correctly installs playwright-cli on Windows (#15559) - 📌 Emulator stability — Pinned Kusto emulator image and improved Cosmos DB emulator reliability (#15504) ✨ Improvements - 🏗️ Brownfield TypeScript aspire init — Running aspire init in existing JS/TS projects now smartly merges package.json — scripts, dependencies, and engines — with semver-aware conflict handling (#15123) - 🎯 Endpoint filtering — New ExcludeReferenceEndpoint property lets you filter specific endpoints from WithReference (#15586) - 🌐 More polyglot ATS APIs — Exported additional hosting APIs for TypeScript and Go AppHost authoring (#15557) - 🔍 Short trace ID support — The dashboard now resolves short trace IDs in addition to full-length ones (#15613) - ⚠️ Aspire.Hosting.NodeJs deprecated — Use Aspire.Hosting.JavaScript instead; the old package no longer appears in aspire add (#15686) ## 13.2.0 # Aspire 13.2 Aspire 13.2 brings major CLI enhancements, a new TypeScript AppHost (preview), dashboard data export/import, Microsoft Foundry integration, and multi-language improvements — all focused on making local development more streamlined for developers and AI coding agents alike. ## Highlights - 🛠️ CLI overhaul — New commands including **aspire start/stop/ps** for detached mode, **aspire describe** for resource monitoring, **aspire doctor** for environment diagnostics, **aspire secret** for managing user secrets, **aspire docs** for browsing documentation from the terminal, and **aspire agent** (renamed from **aspire mcp**) for AI agent integration. - 🌐 TypeScript AppHost (preview) — Write your apphost in TypeScript with **createBuilder()**, using the same app model concepts as C#. Full VS Code extension support included. - 🧩 VS Code extension — Dedicated Aspire Activity Bar panel with live resource state, inline CodeLens with health status and actions, gutter decorations, and a new Getting Started walkthrough. - 📊 Dashboard improvements — Bulk telemetry export/import, export environment variables as **.env** files, a new telemetry HTTP API, set parameters directly from the dashboard, and improved resource graph layout. - 🤖 Microsoft Foundry — Replaces Azure AI Foundry integration with broader **Aspire.Hosting.Foundry** support including hosted agents and model deployments. - 🔒 Azure Virtual Network & Private Endpoints — New **Aspire.Hosting.Azure.Network** integration for defining VNets, subnets, NAT gateways, NSGs, and private endpoints directly in your apphost. - 🐳 Docker Compose publishing — Generate docker-compose.yaml from your app model with **AddDockerComposeEnvironment.** - 📦 New integrations — Azure Data Lake Storage, MongoDB EF Core (**Aspire.MongoDB.EntityFrameworkCore**), Bun support for JS resources, and Certbot for automated SSL certificates. - ⚡ App model — **WithMcpServer** for declaring MCP endpoints, **rebuild** command for project resources, contextual endpoint resolution, and improved secret/certificate handling. ## ⚠️ Breaking changes Notable breaking changes include service discovery env vars now using endpoint scheme instead of name, aspire.config.json replacing split config files, AIFoundry → Foundry rename, WithSecretBuildArg → WithBuildSecret, and updated default Azure credential behavior. [See the full list of breaking changes](https://aspire.dev/whats-new/aspire-13-2/#%EF%B8%8F-breaking-changes). ## 📖 Learn more For the full details on everything in this release, check out the [What's new in Aspire 13.2](https://aspire.dev/whats-new/aspire-13-2/) documentation. Thank you to all the community contributors who helped make this release happen! 💜 ## 13.1.3 ## What's Changed * [release/13.1] Add installer publishing updates for 13.1.3 by @radical in https://github.com/dotnet/aspire/pull/15158 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.2...v13.1.3 ## 13.1.2 ## What's Changed * Bump patch version from 13.1.1 to 13.1.2 by @Copilot in https://github.com/dotnet/aspire/pull/14699 * [release/13.1] Fix template version parsing for .NET 10.0 SDK separator change by @JamesNK in https://github.com/dotnet/aspire/pull/14698 * Update pipeline images to non-deprecated pools by @joperezr in https://github.com/dotnet/aspire/pull/14707 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.1...v13.1.2 ## 13.1.1 ## What's Changed * [release/13.1] Ensure WithHostHttpsPort works when chained inline by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13678 * [release/13.1] Escape backslashes in path string to discovered vite config by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13822 * [release/13.1] [Testing] Fixing bugs for sticky slot app settings by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13810 * [release/13.1] Fix AzureBicepResource file-not-found error when using templateFile with AzurePublishingContext by @github-actions[bot] in https://github.com/dotnet/aspire/pull/14018 * [release/13.1] Filter dev certs without X509SubjectKeyIdentifierExtension when any cert has it by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13676 * [release/13.1] Fix Aspire.ProjectTemplates build failure from command line length limits by @github-actions[bot] in https://github.com/dotnet/aspire/pull/14009 * [release/13.1] Update Azure.Identity package version to 1.17.1 by @eerhardt in https://github.com/dotnet/aspire/pull/14251 * Bump patch version from 13.1.0 to 13.1.1 by @Copilot in https://github.com/dotnet/aspire/pull/14329 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.0...v13.1.1 ## 13.1.0 We are excited to share that our 13.1.0 release of Aspire has shipped! All of the packages are available in NuGet.org now. Head over to https://aspire.dev/whats-new/aspire-13-1/ to find what's new in 13.1.0! ## What's Changed * Target net10.0 in client integrations by @eerhardt in https://github.com/dotnet/aspire/pull/12500 * Fix DockerComposeEnvironment duplicating image names in .env file by @Copilot in https://github.com/dotnet/aspire/pull/12310 * Replace apt-get with npm for Azure Functions Core Tools installation by @Copilot in https://github.com/dotnet/aspire/pull/12537 * Improve flaky dashboard integration test by @JamesNK in https://github.com/dotnet/aspire/pull/12534 * Add README.md for the Aspire.Hosting.Azure.AppService package by @ShilpiRach in https://github.com/dotnet/aspire/pull/12528 * Add support to enable automatic scaling for App Service Environment by @ShilpiRach in https://github.com/dotnet/aspire/pull/12305 * Update to FluentUI 4.13.1 by @JamesNK in https://github.com/dotnet/aspire/pull/12532 * Skip playground projects in build-packages workflow by @Copilot in https://github.com/dotnet/aspire/pull/12547 * Allow HostUrl to remap both address and port by @danegsta in https://github.com/dotnet/aspire/pull/12521 * Refactor NodeJs Integration by @eerhardt in https://github.com/dotnet/aspire/pull/12530 * Fix MCP endpoint with redirect HTTPS by @JamesNK in https://github.com/dotnet/aspire/pull/12556 * [main] Update dependencies from microsoft/usvc-apiserver by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12540 * Refactor AddNodeApp by @eerhardt in https://github.com/dotnet/aspire/pull/12538 * Update Aspire branding from 13.0 to 13.1 by @Copilot in https://github.com/dotnet/aspire/pull/12527 * Add annotation to specify custom base images for generated Dockerfiles by @Copilot in https://github.com/dotnet/aspire/pull/12566 * Fix generating random MCP endpoint URL in templates by @JamesNK in https://github.com/dotnet/aspire/pull/12558 * [CI] Add new Agent for disabling or quarantining tests by @radical in https://github.com/dotnet/aspire/pull/12570 * Add `ExcludeFromMcp()` resource extension by @JamesNK in https://github.com/dotnet/aspire/pull/12515 * Localized file check-in by OneLocBuild Task: Build definition ID 1309: Build ID 2828818 by @dotnet-bot in https://github.com/dotnet/aspire/pull/12546 * Register IPipelineOutputService in DI for pipeline output directory management by @Copilot in https://github.com/dotnet/aspire/pull/12563 * Add deploy support for Docker Compose by @captainsafia in https://github.com/dotnet/aspire/pull/12548 * Quarantine flaky test: AzureServiceBusEmulatorResourceGeneratesConfigJsonWithCustomizations by @Copilot in https://github.com/dotnet/aspire/pull/12578 * Update connection properties for non-Azure resources by @sebastienros in https://github.com/dotnet/aspire/pull/12583 * Filter to highest package version per channel in aspire add command by @Copilot in https://github.com/dotnet/aspire/pull/12553 * Log DCP messages at Debug/Trace level in AppHost by @Copilot in https://github.com/dotnet/aspire/pull/12533 * Add CLI self-update prompts to `aspire update` command by @Copilot in https://github.com/dotnet/aspire/pull/12395 * Fix golang and alpine images. by @mitchdenny in https://github.com/dotnet/aspire/pull/12592 * Replace ContainerTargetPlatform.AllLinux with LinuxAmd64 by @Copilot in https://github.com/dotnet/aspire/pull/12596 * [main] Update dependencies from microsoft/usvc-apiserver by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12610 * Make IReportingStep and IReportingTask completion idempotent by @Copilot in https://github.com/dotnet/aspire/pull/12602 * Show --log-level debug hint when pipeline fails by @Copilot in https://github.com/dotnet/aspire/pull/12603 * [main] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12622 * Rename app.py to main.py in template by @eerhardt in https://github.com/dotnet/aspire/pull/12628 * bump extension version by @adamint in https://github.com/dotnet/aspire/pull/12623 * don't build apphost in cli when running in extension by @adamint in https://github.com/dotnet/aspire/pull/12621 * Detect which version of yarn is being used by @eerhardt in https://github.com/dotnet/aspire/pull/12633 * Fix duplicate key exception when using WithExplicitStart() on resources with environment callbacks by @Copilot in https://github.com/dotnet/aspire/pull/12604 * Support AddCSharpApp, fix some rough edges around project resources by @adamint in https://github.com/dotnet/aspire/pull/12568 * Add missing namespace to `CertificateAuthorityCollectionResource` by @danegsta in https://github.com/dotnet/aspire/pull/12639 * Add ModelContextProtocol assemblies to signing list by @joperezr in https://github.com/dotnet/aspire/pull/12637 * Generate fallback Dockerfile for Python apps without UV by @Copilot in https://github.com/dotnet/aspire/pull/12627 * Update/bump container image tags for hosting components by @joperezr in https://github.com/dotnet/aspire/pull/12459 * Mark IDeveloperCertificateService experimental by @danegsta in https://github.com/dotnet/aspire/pull/12648 * Wait with exponential backoff for expected Executables by @karolz-ms in https://github.com/dotnet/aspire/pull/12647 * Make ProcessCertificateTrustConfigAsync internal by @danegsta in https://github.com/dotnet/aspire/pull/12649 * Add test cases and ensure container cert override paths work by @danegsta in https://github.com/dotnet/aspire/pull/12654 * Python hosting: Support .venv lookup by walking up parent directories by @Copilot in https://github.com/dotnet/aspire/pull/12616 ... (truncated) ## 13.0.2 This patch is updating our Project Templates for our Python starter app to ensure we depend on the latest version of React. This is out of an abundance of caution, as we don't depend on any of the react packages that were flagged as vulnerable in https://github.com/advisories/GHSA-fv66-9v8q-g76r. ## What's Changed * Bump patch version from 13.0.1 to 13.0.2 by @Copilot in https://github.com/dotnet/aspire/pull/13324 * Update React and ReactDOM to version 19.2.1 across all projects by @joperezr in https://github.com/dotnet/aspire/pull/13325 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.0.1...v13.0.2 ## 13.0.1 ## What's Changed * Merge internal changes by @joperezr in https://github.com/dotnet/aspire/pull/12896 * [release/13.0] Fix Azure roles resources always redeploying by @github-actions[bot] in https://github.com/dotnet/aspire/pull/12903 * [release/13.0] Remove .py and .js files from being signed (#13005) by @eerhardt in https://github.com/dotnet/aspire/pull/13032 * [release/13.0] Fix subscription ID not being disabled on Azure provisioning dialog by @github-actions[bot] in https://github.com/dotnet/aspire/pull/12913 * [release/13.0] Default OpenAISettings.EnableSensitiveTelemetryData to TelemetryHelpers.EnableSensitiveDataDefault by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13017 * Bump patch version from 13.0.0 to 13.0.1 by @Copilot in https://github.com/dotnet/aspire/pull/13167 * [release/13.0] EndpointReference evaluation should wait on missing AllocatedEndpoint (#13074) by @karolz-ms in https://github.com/dotnet/aspire/pull/13076 * [release/13.0] Update to Npgsql 10 by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13166 * [release/13.0] Update dependencies from microsoft/usvc-apiserver by @danegsta in https://github.com/dotnet/aspire/pull/13187 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.0.0...v13.0.1 Commits viewable in [compare view](https://github.com/microsoft/aspire/compare/v13.0.0...v13.3.0). </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
56422ada8a |
.Net: Bump follow-redirects from 1.15.11 to 1.16.0 in /dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend (#13877)
Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.11 to 1.16.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/0c23a223067201c368035e82954c11eb2578a33b"><code>0c23a22</code></a> Release version 1.16.0 of the npm package.</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/844c4d302ac963d29bdb5dc1754ec7df3d70d7f9"><code>844c4d3</code></a> Add sensitiveHeaders option.</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/5e8b8d024e2c76f804a284258e585ecb49a575be"><code>5e8b8d0</code></a> ci: add Node.js 24.x to the CI matrix</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/7953e2255aa0b93602eed3804f3bc5e6923a03af"><code>7953e22</code></a> ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/86dc1f86e4b56bcd642c78384d51f10f123aea75"><code>86dc1f8</code></a> Sanitizing input.</li> <li>See full diff in <a href="https://github.com/follow-redirects/follow-redirects/compare/v1.15.11...v1.16.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
a5e8f9b432 |
.Net: Bump form-data from 4.0.5 to 4.0.6 in /dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend (#14082)
Bumps [form-data](https://github.com/form-data/form-data) from 4.0.5 to 4.0.6. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/form-data/form-data/blob/master/CHANGELOG.md">form-data's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6">v4.0.6</a> - 2026-06-12</h2> <h3>Commits</h3> <ul> <li>[Fix] escape CR, LF, and <code>"</code> in field names and filenames <a href="https://github.com/form-data/form-data/commit/8dff42c6da654ed4e7ad4acb7f8ccd3831217c99"><code>8dff42c</code></a></li> <li>[Dev Deps] update <code>@ljharb/eslint-config</code>, <code>auto-changelog</code>, <code>tape</code> <a href="https://github.com/form-data/form-data/commit/f31d21ef10bf46e46344c3ee4f99acbef6be43e1"><code>f31d21e</code></a></li> <li>[Deps] update <code>hasown</code>, <code>mime-types</code> <a href="https://github.com/form-data/form-data/commit/92ae0eb5da94d6f01925d5f4fcffb2a1e50ed7cd"><code>92ae0eb</code></a></li> <li>[Dev Deps] update <code>js-randomness-predictor</code> <a href="https://github.com/form-data/form-data/commit/67b0f65c2e0b065a511d42227d35e4d367644e97"><code>67b0f65</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435"><code>64190db</code></a> v4.0.6</li> <li><a href="https://github.com/form-data/form-data/commit/92ae0eb5da94d6f01925d5f4fcffb2a1e50ed7cd"><code>92ae0eb</code></a> [Deps] update <code>hasown</code>, <code>mime-types</code></li> <li><a href="https://github.com/form-data/form-data/commit/f31d21ef10bf46e46344c3ee4f99acbef6be43e1"><code>f31d21e</code></a> [Dev Deps] update <code>@ljharb/eslint-config</code>, <code>auto-changelog</code>, <code>tape</code></li> <li><a href="https://github.com/form-data/form-data/commit/8dff42c6da654ed4e7ad4acb7f8ccd3831217c99"><code>8dff42c</code></a> [Fix] escape CR, LF, and <code>"</code> in field names and filenames</li> <li><a href="https://github.com/form-data/form-data/commit/67b0f65c2e0b065a511d42227d35e4d367644e97"><code>67b0f65</code></a> [Dev Deps] update <code>js-randomness-predictor</code></li> <li>See full diff in <a href="https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Evan Mattson
|
cd1b0205fa |
Python: Bump Python version to 1.43.1 for a release. (#14093)
### Motivation and Context Bump Python version to 1.43.1 for a release. <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Bump Python version to 1.43.1 for a release. <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [X] I didn't break anyone 😄python-1.43.1 |
||
|
Roger Barreto
|
6ba60965bd |
Python: Reject encoded dot-segment paths in OpenAPI plugin (.NET and Python) (#14086)
## Motivation and Context Closes #14085. The .NET and Python OpenAPI plugins select operations using the raw OpenAPI path, but build the runtime request URL from a canonicalized path. Encoded dot-segments such as `/resources/%2e%2e/admin` pass an `OperationSelectionPredicate` path check, yet `System.Uri` (.NET) and `urljoin` (Python) collapse them to a different route at request time. The selected path and the actual request target can therefore diverge. ## Description - **.NET** (`RestApiOperation.ValidatePathSegments`): decodes each path segment until stable (handling double encoding like `%252e` and encoded separators `%2f`/`%5c`) before rejecting canonical `.` or `..` segments. - **Python** (`RestApiOperation.build_path`): adds equivalent decode-then-reject validation before the URL is built. Regression tests on both stacks cover literal and encoded dot-segments, mixed case, encoded slashes, and double encoding, plus negative tests confirming legitimate encoded characters still work. Test results: - .NET: 482/482 `Functions.UnitTests` OpenApi tests pass. - Python: 109/109 `openapi_plugin` unit tests pass. ## Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the SK Contribution Guidelines - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 |
||
|
|
7fd75c3c73 |
.Net: fix: prevent duplicate "null" in JSON Schema type arrays for nullable parameters (#13635)
## Summary - Fixes `InsertNullTypeIfRequired()` producing duplicate `"null"` entries in JSON Schema type arrays (e.g., `["string", "null", "null"]`) for `Nullable<T>` parameters with `= null` defaults - Replaces reference-equality guard (`JsonArray.Contains()`) with value-based `.Any()` check - Adds 3 regression tests covering both trigger paths and positive insertion ## Root Cause `InsertNullTypeIfRequired()` in `OpenAIFunction.cs` uses `jsonArray.Contains(NullType)` to check for existing `"null"` entries before adding one. `JsonArray.Contains()` compares `JsonNode` objects by reference equality — `JsonNode` does not override `Equals()`. The `NullType` constant (`"null"`) creates a new `JsonNode` on implicit conversion, so the guard always fails and `"null"` is always added as a duplicate. For `Nullable<T>` parameters with `= null` defaults, `AIJsonUtilities.CreateJsonSchema()` correctly produces `["string", "null"]`. The strict-mode sanitizer then attempts to add `"null"` again — the broken guard lets it through, producing `["string", "null", "null"]`. Two trigger paths reach the same bug: 1. Optional parameters (`IsRequired = false`) → `insertNullType = true` 2. Schemas with `"nullable": true` keyword ## Changes | File | Change | |------|--------| | `dotnet/src/Connectors/Connectors.OpenAI/Core/OpenAIFunction.cs` | Replace `jsonArray.Contains(NullType)` with value-based `.Any()` check (follows existing pattern in `NormalizeAdditionalProperties`) | | `dotnet/src/Connectors/Connectors.OpenAI.UnitTests/Core/OpenAIFunctionTests.cs` | 3 new tests: duplicate prevention for optional params, duplicate prevention for `nullable` keyword, positive case (null inserted when absent) | ## Testing - 3 new unit tests added covering: - `ItDoesNotInsertDuplicateNullInTypeArrayForOptionalParameter` — schema with pre-existing `["string", "null"]` + `IsRequired = false` - `ItDoesNotInsertDuplicateNullInTypeArrayForNullableKeyword` — schema with `"nullable": true` + `IsRequired = true` - `ItInsertsNullInTypeArrayWhenAbsent` — schema with `["string"]` only → `"null"` correctly added Fixes #13527 --------- Co-authored-by: Claude Opus 4.6 <[email protected]> Co-authored-by: SergeyMenshykh <[email protected]> Co-authored-by: SergeyMenshykh <[email protected]> Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
f8c757b218 |
Fix MessagePack high severity vulnerability (#14079)
Pin MessagePack to 3.1.7 to resolve NU1903 error for known vulnerability in transitive dependency 2.5.192 brought in by Aspire packages. --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
61331d834d |
Python: Add function_choice_behavior support to Azure AI and OpenAI Assistant agents (#14057)
### Description Adds `function_choice_behavior` parameter to Azure AI and OpenAI Assistant agents, aligning them with the existing Responses agent and Chat Completion agent APIs. ### Changes - Add `function_choice_behavior` parameter to `invoke`/`invoke_stream`/`get_response` on both `AzureAIAgent` and `OpenAIAssistantAgent` public APIs - Add `function_choice_behavior` parameter to internal `AzureAIAgentThreadActions` and `AssistantThreadActions` `invoke`/`invoke_stream` methods - Support `tools` parameter override for SDK-level tools (CodeInterpreter, FileSearch, etc.) - Filter kernel functions based on `FunctionChoiceBehavior` configuration - Validate that only `Auto` type with auto-invoke enabled is supported - Fix `_get_tools` in OpenAI path to use passed `kernel` parameter instead of `agent.kernel` - Add comprehensive unit tests for both thread actions and public agent APIs --------- Co-authored-by: Copilot <[email protected]> |
||
|
Evan Mattson
|
417d62f8b1 |
Python: Bump Python package version to 1.43.0 for a release (#14052)
### Motivation and Context Bump Python package version to 1.43.0 for a release <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Bump Python package version to 1.43.0 for a release <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄python-1.43.0 |
||
|
semenshi-mandCopilot
|
32e904c017 |
.Net: Bump .NET package version to 1.77.0 (#14040)
- Update VersionPrefix from 1.76.0 to 1.77.0 - Update PackageValidationBaselineVersion from 1.75.0 to 1.76.0 Co-authored-by: Copilot <[email protected]>dotnet-1.77.0 |
||
|
Giles OdigweandCopilot
|
d6f832e34a |
ci: harden Python test coverage workflow (#14026)
## Summary Improves the Python test coverage workflow with better input handling and token management. ## Changes - Added validation for the PR number file content before use in environment setup - Switched to using the built-in github.token instead of a PAT for artifact download and PR comments - Added actions: read permission to support artifact download with the built-in token ## Notes The workflow_run trigger provides a github.token scoped to the base repository with the permissions declared in the workflow file. The pull-requests: write permission allows posting comments on PRs, including those opened from forks. Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
3e180c16b3 |
.Net: Enable default-on server URL validation for OpenAPI plugins (#14029)
### Motivation and Context Strengthen the OpenAPI plugin's server URL handling by making validation active by default. ### Description - Introduce `ServerUrlValidator` with host classification and DNS resolution - Make `RestApiOperationServerUrlValidationOptions` enforce validation by default instead of opt-in - Add `AllowPrivateNetworkAccess` opt-out for scenarios that require it - Remove experimental `AllowedSchemes` property (SKEXP0040) - Update `RestApiOperationRunner` to apply validation unconditionally - Add unit tests ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) - [x] The code follows the [.NET coding conventions](https://learn.microsoft.com/dotnet/csharp/fundamentals/coding-style/coding-conventions) - [x] All unit tests pass - [x] New unit tests added --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
644eb0a962 |
Python: [Breaking] Update OpenAPI document parsing options (#14009)
Update OpenAPI document parsing to gate file and HTTP ref resolution separately. ### Breaking change - `RESOLVE_FILES` is no longer enabled by default. Only internal JSON pointer references are resolved by default. - Users with multi-file OpenAPI specs must now pass `enable_file_ref_resolution=True` via `OpenAPIFunctionExecutionParameters`. - `enable_external_ref_resolution` has been renamed to `enable_http_ref_resolution`. --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
58f4a66858 |
Python: Improve function call invocation parameter consistency (#14014)
## Description This PR improves the consistency of how the function_behavior parameter is passed through internal invoke_function_call callsites. ### Changes - Thread function_behavior parameter through all internal invoke_function_call callsites for consistent parameter handling: - Realtime connector (_open_ai_realtime.py) - Responses agent (responses_agent_thread_actions.py) - Assistant agent (assistant_thread_actions.py) - Azure AI agent (agent_thread_actions.py) - Bedrock agent (bedrock_agent.py) - Add defensive logging in kernel.py when function_behavior is not provided - Add unit tests covering parameter handling scenarios ### Testing - All existing tests pass (678 passed, 0 failed) - 5 new tests added covering the updated parameter handling Co-authored-by: Copilot <[email protected]> |
||
|
Evan Mattson
|
2fb749e4bb |
Python: Bump Python pkg version to 1.42.0 for a release. (#14007)
### Motivation and Context Bump Python pkg version to 1.42.0 for a release. <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Bump Python pkg version to 1.42.0 for a release. <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [X] I didn't break anyone 😄python-1.42.0 |
||
|
Evan MattsonandCopilot
|
a6c68af594 |
Python: Improvements for MCP (#14003)
### Motivation and Context Improvements for MCP tool calls by adding an optional sampling callback. <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Improvements for MCP tool calls by adding an optional sampling callback. <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
32abf99e29 |
Python: Harden HttpPlugin request validation (#13969)
Improve input validation and request handling in the Python HttpPlugin. ### Changes - Add explicit opt-in for unrestricted domain access - Tighten URL validation logic - Improve redirect handling when domain restrictions are configured - Add regression tests --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
a7cea9ab64 |
Python: Stop accessing private Azure SDK attributes in Azure AI Search connector (#13971)
### Motivation and Context CI fails with `AttributeError: 'SearchIndexClient' object has no attribute '_endpoint'` when `azure-search-documents` resolves to 12.0.0 (released 2026-04-01). The 12.0.0 release migrated from AutoRest to TypeSpec code generation, removing private attributes `_endpoint` and `_credential` from `SearchIndexClient`. CI uses `uv sync -U` which upgrades past the lockfile, pulling in 12.0.0 since `pyproject.toml` specifies `>= 11.6.0b4` with no upper bound. ### Description Stop reading `SearchIndexClient._endpoint` and `._credential`. Instead, store endpoint and credential as explicit fields on `AzureAISearchStore` and `AzureAISearchCollection`, and pass them directly when constructing `SearchClient`. **Changes:** - `_get_search_client()` accepts explicit `endpoint` + `credential` params instead of extracting from `SearchIndexClient` private attrs - `_resolve_credential()` new helper extracted from `_get_search_index_client()` for reuse - `AzureAISearchStore` / `AzureAISearchCollection` store `search_endpoint` and `search_credential` as fields, thread them through construction - Tests updated to assert on public fields instead of private SDK attributes ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] All unit tests pass with both `azure-search-documents==11.7.0b2` and `==12.0.0` - [x] No breaking changes to public API --------- Co-authored-by: Copilot <[email protected]> |
||
|
Roger BarretoandCopilot
|
fdc6e68f58 |
.Net: Semantic Kernel -> Agent Framework - Migration/Samples Update (AF 1.0 Compatible) (#13852)
## Description Updates the SK → Agent Framework migration document, samples, and bridge code from AF preview (`1.0.0-preview.251009.1`) to GA (`1.0.0`). ### Breaking changes addressed | Preview API | AF 1.0 GA | Scope | |---|---|---| | `AgentThread` | `AgentSession` | Core type rename | | `GetNewThread()` | `CreateSessionAsync()` | Now async | | `AgentRunResponse` | `AgentResponse` | Return type rename | | `AgentRunResponseUpdate` | `AgentResponseUpdate` | Streaming type rename | | `CreateAIAgent()` | `AsAIAgent()` | Extension method rename | | `AssistantClient.CreateAIAgentAsync()` | **Removed** | Redirect to Responses API | | `PersistentAgentsClient` | **Obsolete** | Use `AIProjectClient` via `Microsoft.Agents.AI.Foundry` | | `Microsoft.Agents.AI.AzureAI` | `Microsoft.Agents.AI.Foundry` | Package rename | | `InProcessExecution.StreamAsync` | `RunStreamingAsync` | Workflow API | | `AgentRunUpdateEvent` | `AgentResponseUpdateEvent` | Workflow event | | `AIAgent.Id` (virtual) | `IdCore` (protected virtual) | Override pattern | ### Additional discoveries - `using OpenAI.Chat;` required for `ChatClient.AsAIAgent()` extension to resolve - `using OpenAI.Responses;` required for `ResponsesClient.AsAIAgent()` extension to resolve ### What changed **Package versions** (`dotnet/Directory.Packages.props`) - AF packages updated to `1.0.0` - `Microsoft.Agents.AI.AzureAI` → `Microsoft.Agents.AI.Foundry` **Bridge code** (`dotnet/src/Agents/Abstractions/AIAgent/`) - `SemanticKernelAIAgent.cs`: New `Core` method overrides (`CreateSessionCoreAsync`, `RunCoreAsync`, etc.) - `SemanticKernelAIAgentThread` → `SemanticKernelAIAgentSession` (extends `AgentSession`) **31 migration samples** (all compile ✅) - OpenAI/AzureOpenAI: `AsAIAgent`, `CreateSessionAsync`, `using OpenAI.Chat;` - Assistants (8): AF sections rewritten to Responses API - Responses (8): Direct `ResponsesClient.AsAIAgent()` - Foundry (4): `AIProjectClient.AsAIAgent()` via `Microsoft.Agents.AI.Foundry` - Orchestrations (3): `RunStreamingAsync`, `AgentResponseUpdateEvent` **Migration document** (`.github/upgrades/prompts/SemanticKernelToAgentFramework.md`) - All AF preview API references updated to 1.0 GA patterns **Unit/integration tests** (~15 files) - Mechanical renames for `AgentSession`, `AgentResponse`, `CreateSessionAsync` ### Validation 8 standalone console programs were created and executed against AF 1.0.0 NuGet packages with real API keys, validating all migration patterns end-to-end: 1. OpenAI Basics (ChatClient → AsAIAgent, CreateSessionAsync, Run/RunStreaming) 2. OpenAI ToolCall (AIFunctionFactory.Create, tool invocation) 3. OpenAI DI (ServiceProvider registration) 4. OpenAI Responses (ResponsesClient.AsAIAgent) 5. Azure AI Foundry (AIProjectClient.AsAIAgent) 6. Workflows Handoff (HandoffWorkflowBuilder, InProcessExecution.RunStreamingAsync) 7. Session Lifecycle (Create, Serialize, Deserialize, multi-turn) 8. Assistants Migration Path (Responses API as replacement) --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
3f0e2d58fa |
Python: Percent-encode OpenAPI path params & pin azure-search-documents (#13967)
Apply `urllib.parse.quote(safe='')` to path parameter values before substitution in `build_path()`, consistent with the .NET implementation which uses `HttpUtility.UrlEncode`. ### Changes - `rest_api_operation.py`: encode path parameter values per RFC 3986 - `test_sk_openapi.py`: add tests for encoded path parameters - `pyproject.toml` / `uv.lock`: pin `azure-search-documents >= 11.6.0b4, < 12.0.0` ### Pin azure-search-documents < 12.0.0 Version 12.0.0 removed the internal `_endpoint` attribute from `SearchIndexClient`, which breaks `AzureAISearchCollection` initialization at `azure_ai_search.py:158`. Pinning to `< 12.0.0` until the code is updated to use the new public API. ### Tests All existing and new `build_path` tests pass. --------- Co-authored-by: Copilot <[email protected]> |
||
|
Roger Barreto
|
590003243a |
.Net: Pin SharpCompress 0.48.0 to fix GHSA-6c8g-7p36-r338 (#13977)
## Summary Fixes a moderate-severity transitive vulnerability flagged by `dotnet list package --vulnerable --include-transitive` across 10 projects in the solution. | Package | Current (resolved) | Pinned | Severity | Advisory | |---|---|---|---|---| | SharpCompress | 0.30.1 | 0.48.0 | Moderate | [GHSA-6c8g-7p36-r338](https://github.com/advisories/GHSA-6c8g-7p36-r338) | ## Why a transitive pin `SharpCompress` is pulled in transitively via `MongoDB.Driver 3.5.2`: `MongoDB.Driver (v3.5.2) -> SharpCompress (v0.30.1)` The latest `MongoDB.Driver` (3.8.0) still declares `SharpCompress (>= 0.30.1)` as a floor, so a minor bump of `MongoDB.Driver` does not lift the resolved `SharpCompress` version. There is no transitive update path through the direct dependency. The advisory's vulnerable range is `<= 0.47.4`, so `0.48.0` is the smallest non-vulnerable release. `1.0.0` was rejected as it is a major-version jump. ## Changes This mirrors the existing `Snappier` vulnerability pin pattern already in the repo (same file locations, same comment style): 1. `dotnet/Directory.Packages.props` -- add `PackageVersion` for `SharpCompress 0.48.0` next to the `MongoDB.Driver` / `Snappier` entries with a vulnerability comment. 2. `dotnet/src/VectorData/MongoDB/MongoDB.csproj` -- add direct `PackageReference Include="SharpCompress"` to override the transitive resolution. 3. `dotnet/src/VectorData/CosmosMongoDB/CosmosMongoDB.csproj` -- same. The pin in the two `Connectors.*` source projects propagates the override to all downstream consumers (samples, integration tests, conformance tests, unit tests). ## Verification | Check | Scope | Result | |---|---|---| | `dotnet list SK-dotnet.slnx package --vulnerable --include-transitive` | Full solution (155 projects) | All clean (was 10 projects flagging) | | `dotnet build --warnaserror` | `MongoDB.csproj` | Pass | | `dotnet build --warnaserror` | `CosmosMongoDB.csproj` | Pass | | `dotnet format --verify-no-changes` (CI-parity Docker `mcr.microsoft.com/dotnet/sdk:10.0`) | Both csproj | Pass (Formatted 0 of N files) | | `dotnet test` | `MongoDB.UnitTests` | 37/37 passed | | `dotnet test` | `CosmosMongoDB.UnitTests` | 28/28 passed | Conformance test projects skipped (require live emulators, pre-existing env-dependent suites, not impacted by a transitive pin). |
||
|
SergeyMenshykhandCopilot
|
f2b3c931d1 |
.Net: Version bump 1.76.0 (#13972)
### Motivation and Context Bump SK .NET version for the next release. ### Description - VersionPrefix: 1.75.0 1.76.0 - PackageValidationBaselineVersion: 1.74.0 1.75.0 Co-authored-by: Copilot <[email protected]>dotnet-1.76.0 |
||
|
SergeyMenshykhandCopilot
|
3dd139b2bd |
.Net: Harden CloudDrivePlugin defaults and add path validation (#13958)
### Description - Improve default settings in CloudDrivePlugin - Add path validation for share-link operations - Improve path canonicalization - Add regression tests ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) - [x] The existing tests pass - [x] New tests added --------- Co-authored-by: Copilot <[email protected]> |