### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
Improve consistency of the built-in OpenAPI HTTP client while preserving
request identity and existing customization points.
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
Refine connection handling and internal validation-result propagation.
Preserve caller-supplied clients and existing redirect behavior. Add
regression coverage for connection selection, pooling, and HTTPS
behavior.
---------
Co-authored-by: Copilot App <[email protected]>
## Motivation and Context
`XmlPromptParser` converts chat prompts such as `<message
role="user">...</message>` into `PromptNode` trees that
`ChatPromptParser` turns into a `ChatHistory`. Each `PromptNode` stores
the serialized inner XML of its element, so the parser re-serializes and
decodes the whole remaining subtree at every nesting level. Parse work
therefore grows with nesting depth multiplied by prompt size, and the
recursive node builder had no depth bound.
Supported chat prompt structure is shallow: message elements with
optional `text`, `image`, `audio`, and `binary` children, plus encoded
or CDATA text. This change bounds element nesting so parsing cost stays
proportional to prompt size.
## Description
- Add `XmlPromptParser.MaxElementDepth` (internal, `64`, top-level
prompt elements count as depth 1, matching the `System.Text.Json`
default maximum depth).
- After the prompt is loaded and before any `PromptNode` is built, a
single non-recursive walk checks element depth. Prompts nested deeper
than the limit return `false` from `TryParse`.
- A rejected prompt takes the existing invalid-XML path: callers such as
`GetChatMessageContentsAsync(string)` send the whole prompt as one user
text message, exactly as they already do for malformed XML.
- Parse work for accepted prompts is bounded by the depth limit times
prompt size, and recursion in `GetPromptNode` is bounded.
- No public API change. Prompts within the limit, including content
items, CDATA, and encoded content, parse exactly as before.
Tests:
- `XmlPromptParserTests`: parses two prompts at exactly the maximum
depth; rejects one level over and far over the limit; rejects when only
a later top-level node exceeds the limit (covers sibling traversal after
a max-depth subtree).
- `ChatPromptParserTests`: a user message whose content exceeds the
limit makes `ChatPromptParser.TryParse` return `false`.
## Validation
All local runs use `-c Debug` on .NET SDK 10.0.401.
- Build with `--warnaserror`: `SemanticKernel.Abstractions` (`net10.0`,
`net8.0`, `netstandard2.0`), `SemanticKernel.UnitTests`,
`Extensions.UnitTests`, `PromptTemplates.Liquid.UnitTests`,
`Agents.UnitTests`, `IntegrationTests`: 0 warnings, 0 errors.
- `dotnet format --verify-no-changes` in
`mcr.microsoft.com/dotnet/sdk:10.0` for both changed projects: clean.
- `SemanticKernel.UnitTests`: 1614/1614 pass, including the 5 new tests.
The new over-limit tests fail without the parser change.
- `Extensions.UnitTests` (Handlebars) 90/90,
`PromptTemplates.Liquid.UnitTests` 16/16, `Agents.UnitTests` 504/504
executed tests pass, `IntegrationTests` CrossLanguage (offline, stubbed
HTTP request shape) 37/37.
- Normal chat prompts produce the same `ChatHistory` on `net10.0`,
`net8.0`, and .NET Framework 4.8 (`netstandard2.0` asset), and the
largest prompts still accepted parse in time proportional to their size.
## Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
### Motivation and Context
Prepares the Semantic Kernel Python package for the `1.45.0` release
after #14551 and #14552 merged.
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Updates `semantic_kernel.__version__` from `1.44.1` to `1.45.0`.
Validated the publishable package with `uv build --no-sources`; it
produced:
- `semantic_kernel-1.45.0.tar.gz`
- `semantic_kernel-1.45.0-py3-none-any.whl`
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
Consolidates the currently open Python Dependabot updates into one
reviewable pull request while preserving the compatibility fixes already
applied to those PRs.
Supersedes #14463, #14462, #14456, #14393, #14392, #14391, #14336, and
#14256.
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
- Updates the root Python dependency ranges for `google-genai` and
`websockets`.
- Keeps `mistralai` on its compatible 1.x API and retains the existing
`mcp<2.0` bound because both 2.x updates break current connectors.
- Updates `onnxruntime-genai` to 0.15.2 for Python 3.11+ while retaining
0.9.0 for Python 3.10.
- Updates the root lockfile to `anyio` 4.14.2, `soupsieve` 2.9,
`google-genai` 1.75.0, `websockets` 16.1.1, and the compatible ONNX
GenAI pins.
- Updates the OAuth server lockfile to `anyio` 4.14.2 and removes its
obsolete `sniffio` dependency.
- Regenerates and validates the lockfiles with the CI-pinned `uv`
0.5.31.
Validation:
- `uvx --from 'uv==0.5.31' uv lock --check` passed for both lockfiles.
- `uvx --from 'uv==0.5.31' uv sync --all-extras --dev --frozen --quiet`
passed.
- `uvx --from 'uv==0.5.31' uv run --frozen pytest ./tests/unit
--ignore=tests/unit/processes/dapr_runtime` passed.
- The OAuth server dependency environment resolves with `uv sync
--frozen --no-install-project`; its editable package build remains
blocked by the sample's pre-existing missing `README.md`.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
Prepares the .NET packages for the next minor release.
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
- Bumps the shared `VersionPrefix` from `1.80.1` to `1.81.0`.
- Advances `PackageValidationBaselineVersion` from `1.80.0` to `1.80.1`.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
Co-authored-by: Copilot App <[email protected]>
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
Align CrewAI task identifier handling across the .NET and Python clients
and fail early for unsupported identifier formats.
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
- Validate CrewAI status task identifiers consistently in both
implementations.
- Add focused unit coverage for accepted and rejected identifier
formats.
- Preserve valid identifiers unchanged in outgoing status requests.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
---------
Co-authored-by: Copilot App <[email protected]>
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
Improve consistency and maintainability of HTTP request validation in
the .NET and Python SDKs.
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
- Extract existing request validation into shared internal utilities and
reuse them in the HTTP plugins.
- Update HTTP plugin configuration and documentation.
- Extend unit coverage for shared validation and plugin behavior.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
---------
Co-authored-by: Copilot App <[email protected]>
### Motivation and Context
Preserve established behavior while making the default configuration
more visible to users.
### Description
- Preserve established default behavior.
- Add a targeted configuration warning.
- Keep explicit validation behavior unchanged and add focused tests.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
Keep raw session download filenames as filename data when constructing
request URLs, while preserving ordinary nested paths.
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
- URL-encode `remote_file_name`, preserving `/` separators for nested
paths.
- Reject literal `.` and `..` path components with
`FunctionExecutionException` before authentication or a request, and
document this constraint.
- Add HTTPX transport-based tests for ordinary and nested filenames,
special characters, literal percent escapes, and early rejection.
Confirm that `download_file` remains outside normal kernel-function
registration.
**Validation** (from `python/`, using an existing uv-managed
environment):
- `uv run --no-sync --no-env-file python -m pytest
tests/unit/core_plugins/test_sessions_python_plugin.py
--disable-warnings`: passed, 74 tests; 14 warnings.
- `uv run --no-sync --no-env-file python -m ruff check --no-cache
semantic_kernel/core_plugins/sessions_python_tool/sessions_python_plugin.py
tests/unit/core_plugins/test_sessions_python_plugin.py`: passed.
- `uv run --no-sync --no-env-file python -m ruff format --check
--no-cache
semantic_kernel/core_plugins/sessions_python_tool/sessions_python_plugin.py
tests/unit/core_plugins/test_sessions_python_plugin.py`: passed.
- `uv run --no-sync --no-env-file python -m mypy --config-file mypy.ini
--follow-imports=silent
semantic_kernel/core_plugins/sessions_python_tool/sessions_python_plugin.py`:
passed.
Installed pre-commit hooks passed during the commit, including
pyupgrade, Ruff, Ruff formatting, and Bandit.
The repository-wide build, all-files pre-commit checks, and full
unit/integration suites were not run.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
### Motivation and Context
Fixes#14312.
`validate_server_url`
(`connectors/openapi_plugin/server_url_validator.py`) is a deliberate
anti-SSRF control: it resolves the operation host and blocks private,
loopback, link-local and metadata addresses. It then returned `None`,
discarding the addresses it had just vetted.
`OpenApiRunner.run_operation` called it and afterwards issued the
request against the *hostname* via
`httpx.AsyncClient(...).request(url=...)`, so httpx resolved the name a
second time when opening the connection. A name that resolves to a
public address during validation and to a private one at connect time —
classic DNS rebinding — passed the check and was then contacted.
`run_operation` attaches `auth_callback` credentials to that request.
**Severity, stated without inflation.** This is hardening, not a
high-severity SSRF, and the issue author already said so. On the default
path the validator forces `https` and httpx verifies certificates, so a
rebind to e.g. `169.254.169.254` fails the TLS handshake: the residual
is a blind TCP connect + ClientHello to an internal address, not
credential disclosure. Reaching actual disclosure requires an
operator-configured `http` `allowed_base_urls` entry, a caller-supplied
client with `verify=False`, or a host platform ingesting untrusted
OpenAPI specs. The feature is `@experimental`. It is worth closing
because the validator exists precisely to stop this, and this is its one
check-time/use-time gap.
### Description
- `validate_server_url` now returns the addresses it actually vetted, in
resolver order. This is additive — it previously returned `None`, so
existing callers are unaffected.
- The runner's built-in client sends the request to one of those
addresses: the URL carries the address, the `Host` header and the
`sni_hostname` extension carry the original hostname. TLS verification
therefore still runs against the hostname (httpcore passes
`sni_hostname` through as `server_hostname` for the handshake) and the
bytes on the wire are unchanged. `httpx.URL.copy_with(host=...)`
preserves IPv6 bracketing, the port and userinfo.
- Remaining vetted addresses are tried if a connection cannot be
established, preserving the resolver's A/AAAA fallback. Only
`ConnectError`/`ConnectTimeout` are retried, so a request that may
already be on the wire is never resent.
- No new module, no new dependency, no custom transport, no private
httpx/httpcore API in shipped code. `sni_hostname` is httpx's documented
extension for exactly this case.
Nothing is pinned where no DNS validation took place: an
`allowed_base_urls` match, `allow_private_network_access`, or a literal
IP host (which cannot be rebound).
For context, #14317 attempted this with a custom `PinnedDnsTransport`
that re-implemented httpx's pool and proxy construction; it was
self-closed unmerged with two review findings still open (environment
proxies bypassed, and only the first resolved address used). This change
avoids the transport entirely and closes both of those points.
### What this does NOT cover
- **Caller-supplied `http_client`** is not pinned. That client owns its
transport — proxies, mounts, custom resolvers, `base_url` — and forcing
an IP through it can break proxying and split-horizon deployments. Its
requests use its own name resolution and remain exposed to the rebinding
gap.
- **Environment proxies** disable pinning on the default path too. A
proxy resolves the target name itself, so an address resolved locally is
neither used for the connection nor necessarily correct from the proxy's
vantage point. The check is deliberately conservative: any configured
`http`/`https`/`all` proxy turns pinning off, and `NO_PROXY` is not
parsed.
- **The `allowed_base_urls` path** still matches on hostname strings
without resolving, as before. Adding resolution there is a policy change
for operators who opted in explicitly, so it is left for a separate
discussion.
- **Redirects are not re-validated.** The built-in client uses httpx's
default `follow_redirects=False`, so this is not reachable there; a
caller-supplied client that enables redirects can still be redirected to
an unvalidated host.
### Tests
New
`tests/unit/connectors/openapi_plugin/test_openapi_runner_dns_pinning.py`
(12 tests):
| Test | What it proves |
| --- | --- |
| `..._pins_connection_to_validated_address_under_dns_rebinding` |
Drives real httpx + httpcore with only the network backend recorded.
First resolution returns a public address, later ones return
`169.254.169.254`. Asserts the socket is opened against the vetted
address, the TLS SNI is the original hostname, `Host:` on the wire is
the original hostname, and the host is resolved exactly once. |
| `..._pins_request_url_and_preserves_host_identity` | Request URL is
the vetted IP; `Host` and `sni_hostname` are the hostname. |
| `..._pins_first_validated_address_when_several_are_returned` | The
resolver's preferred address is used, not an arbitrary one. |
| `..._falls_back_to_the_next_validated_address_on_connect_error` | A
connect failure falls through to the remaining vetted addresses, in
order. |
| `..._does_not_retry_a_request_that_may_already_have_been_delivered` |
A read timeout is not retried against a second address, so the request
is not delivered twice. |
| `..._brackets_ipv6_address_and_preserves_the_port` | IPv6 pin stays a
parseable URL, and the port survives in both the URL and the `Host`
header. |
| `..._does_not_pin_when_an_allowed_base_url_matches` | Allowed-base-url
path is untouched. |
| `..._does_not_pin_when_private_network_access_is_allowed` | The
private-network opt-in is not silently overridden. |
| `..._does_not_pin_a_literal_ip_host` | A literal address is left
exactly as it was. |
| `..._does_not_pin_when_an_environment_proxy_is_configured` | Proxy
users keep their existing routing. |
| `..._does_not_pin_a_caller_supplied_client` | A supplied client's
requests are unmodified. |
| `..._still_blocks_a_host_that_resolves_to_a_private_address` | Pinning
did not weaken the existing block. |
Plus 5 tests in `test_server_url_validator.py` covering the return
contract: vetted IPv4 and IPv6 lists, and the empty list for
allowed-base-url, private-network opt-in and literal-IP hosts.
Every new assertion-bearing test was confirmed failing on the unfixed
code before it passed on the fixed code — 11 of them fail on `main`, the
rebinding one with `connection was opened against 169.254.169.254, not
the validated address`. The "does not pin" guards assert unchanged
behaviour and so cannot go red against `main`; each was instead
validated by deliberately weakening the fix (pin IPv4 only; drop the SNI
extension; drop the `Host` header; drop the port from `Host`; pin the
wrong list element; pin despite a proxy; naive URL build; pin a literal
IP; pin despite `allow_private_network_access`; pin on the
`allowed_base_urls` path; pin a caller-supplied client; retry on any
error rather than connection errors) — every weakening was caught. The
last two of those weakenings were found during an independent
verification pass, and the read-timeout test above was added because
that pass showed nothing yet proved the no-double-delivery claim.
```
uv run pytest tests/unit/connectors/openapi_plugin/ 200 passed in 5.60s
uv run ruff check semantic_kernel tests All checks passed! (ruff 0.9.6, the version .pre-commit-config.yaml pins)
uv run ruff format --check <changed files> already formatted
uv run mypy semantic_kernel/connectors/openapi_plugin Success: no issues found in 22 source files
uv run pytest tests/unit 3069 passed (baseline on pristine main 3052; +17 = exactly the new tests)
```
The broader `tests/unit` run has 17 pre-existing failures (16 ONNX, 1
OpenAI text-to-image) and 42 collection errors from optional extras that
could not be installed on the machine used here (`torch` publishes no
x86_64 macOS wheel). Both were measured on pristine `main` as well and
the failure sets are identical with and without this change; no
dependency pin was modified.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] I didn't break anyone 😄
Authored by Mycroft, the synthetic co-founder at Anton Dzyatkovsky's lab
(autonomous mode; named responsible person: Anton Dziatkovskii). The
test runs above were independently re-executed before submission.
---------
Signed-off-by: tonydzi <[email protected]>
Co-authored-by: Anton Dziatkovskii <[email protected]>
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
### Motivation and Context
Ensure `FileIOPlugin` applies its configured access rules consistently
and provides predictable error responses. This improves reliability for
applications exposing file operations through kernel functions.
### Description
Refines `FileIOPlugin` path validation and error handling while
preserving its public API and configured folder restrictions. Adds
regression coverage for both default and explicitly configured settings,
including consistent error responses and continued enforcement of
file-access rules.
---------
Co-authored-by: Copilot App <[email protected]>
### Motivation and Context
### Description
- Improve PostgreSQL query construction for search filters.
- Expand unit and integration coverage for filtered searches.
- Clarify supported filter input in the connector documentation.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
## Summary
- Keep the first function when MCP tool names collide, warn for skipped
duplicates, and dispatch calls to the exact advertised function.
- Add opt-in plugin-qualified tool names and warn when names exceed
MCP's recommended length.
- Update MCP server documentation and cover naming, duplicate
registration, exclusions, dispatch, and agent forwarding with tests.
## Validation
- 70 focused MCP connector and agent tests passed.
- Ruff formatting passed; four changed Python files lint clean. The six
Ruff property-docstring findings in agent.py also occur at the upstream
base.
---------
Co-authored-by: Copilot App <[email protected]>
Disable failing OpenAI integration and sample cases while the CI API key
returns HTTP 401. Keep other providers and OpenAPI cross-language
coverage enabled.
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
---------
Co-authored-by: Copilot App <[email protected]>
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Improve Milvus filtering to allow more id types to be supported
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
The .NET integration job in
https://github.com/microsoft/semantic-kernel/actions/runs/36585640900/job/109465158271
failed on direct OpenAI API calls because the configured key was
rejected (401) and the account had exhausted its credits (429).
Temporarily pause those cases while credentials and billing are
restored; Azure OpenAI failures are separate and are not addressed here.
### Description
- Skip direct OpenAI connector tests in code with an explicit temporary
reason.
- Skip only the OpenAI-backed data rows of response-agent tests; retain
Azure-backed rows.
- Temporarily disable the OpenAI response-agent conformance classes that
require the direct API. Keep their imports and declarations available
for re-enabling.
- Leave the integration-test workflow unchanged.
Focused validation: the integration-test project compiled, and the
selected OpenAI test cases reported 12 skipped, 0 failed. Azure OpenAI
service errors from the original run can still cause the job to fail.
### Contribution Checklist
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
---------
Co-authored-by: Copilot App <[email protected]>
### Motivation and Context
DevFlow currently starts PR reviews for all contributors. Align its
review eligibility with Microsoft Agent Framework by checking membership
in the internal developer team before running the review.
### Description
- Split the workflow into `prepare_pr`, `team_check`, and `review` jobs.
The review runs only when the team check succeeds.
- Check the **PR author** for automatic runs and the **person starting
the workflow** for manual runs. Draft PRs follow the same eligibility
check as other PRs.
- Add a team-membership helper that uses the team slug supplied by
`DEVELOPER_TEAM`, plus a `team-check` GitHub App token profile with
member and PR read permissions.
- Keep SK's existing spam/relevance check and DevFlow review steps.
- Add tests for the membership helper and token profile, and include the
helper in the automation test workflow's path filters.
---------
Co-authored-by: Copilot App <[email protected]>
Upgrade Microsoft.SourceLink.GitHub to 10.0.303 so its transitive
Microsoft.Build.Tasks.Git dependency uses the patched release.
Co-authored-by: Copilot App <[email protected]>
### Motivation and Context
Semantic Kernel workflows currently depend on the user-scoped
`GH_ACTIONS_PR_WRITE` token for issue labels, pull-request labels, and
DevFlow GitHub API writes. Reduced PAT lifetimes make these automations
operationally fragile and require frequent manual rotation.
This change introduces the dedicated `semantic-kernel-automation` GitHub
App, installed only on `microsoft/semantic-kernel`, and uses short-lived
installation tokens signed through Azure Key Vault HSM. Fixes#14410.
### Description
- Add a reusable composite action that authenticates to Azure through
GitHub Actions OIDC, signs the GitHub App JWT through Key Vault without
exposing private-key material, and exchanges it for a repository-scoped
installation token.
- Mint least-privilege tokens for issue labeling, pull-request labeling,
and DevFlow repository operations.
- Migrate `label-issues.yml`, `label-pr.yml`, and
`devflow-pr-review.yml` to App-first authentication with the existing
PAT retained temporarily as a controlled rollout fallback.
- Keep DevFlow GitHub API writes on the App token while Copilot
continues to use the built-in Actions token with `copilot-requests:
write`.
- Add focused JavaScript tests for JWT construction, HSM signature
conversion, permission scoping, malformed configuration, and GitHub API
failures.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
Copilot-Session: d9fa4e9c-c32d-42fb-8ee4-4772473e6479
### Motivation and Context
Currently, the Python connectors for Google AI and Vertex AI don't pass
the standard semantic-kernel user agent string. This PR adds the user
agent header so that the Google API calls properly identify Semantic
Kernel.
This aligns with the dotnet implementation, and our (Google DeepMind's)
[best
practices](https://ai.google.dev/gemini-api/docs/partner-integration).
### Description
Sends the `User-Agent` header conditionally in `GoogleAIChatCompletion`,
`GoogleAITextCompletion`, and `GoogleAITextEmbedding`, matching the
OpenAI implementation as much as possible (gated behind telemetry flag,
using `SEMANTIC_KERNEL_USER_AGENT`).
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄.
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
## Summary
- bump SK .NET packages from 1.80.0 to 1.80.1
- update the package validation baseline from 1.79.0 to 1.80.0
## Rationale
Changes since dotnet-1.80.0 are maintenance updates without new public
APIs or features, so this is a patch release.
Co-authored-by: Copilot App <[email protected]>
Copilot-Session: be9e3ab4-e9ee-4871-8b21-a62c2b732f74
## Summary
- update Transformers and related Hugging Face packages
- refresh Python dependencies used by the MCP OAuth demo
- regenerate the affected uv lockfiles
- adapt the Hugging Face text completion connector to Transformers 5
- temporarily disable live tests that depend on the retired Assistants
API
## Hugging Face connector
Transformers 5 removes the `text2text-generation`, `summarization` and
`translation` pipeline tasks, so `HuggingFaceTextCompletion` raised
`KeyError: Unknown task text2text-generation` on construction.
Those two tasks now use a small adapter built on `AutoModelForSeq2SeqLM`
and `AutoTokenizer` that preserves what the removed pipelines did:
- the same output keys (`summary_text` for summarization,
`generated_text` otherwise), so the content mapping is unchanged
- the model's task specific prefix (e.g. `summarize: `) is still
prepended before tokenization
- one record per generated sequence when `num_return_sequences > 1`
- `model_kwargs` are shared with the tokenizer load, as `pipeline()` did
- pipeline only options are dropped with a warning instead of reaching
`generate()`
`text-generation` keeps using `pipeline()`. There is no public API
change.
The previous unit tests mocked `pipeline()` and so did not catch the
incompatibility. New tests cover the adapter, option routing, device
placement, output mapping and prefix resolution.
## Temporarily disabled tests
The OpenAI and Azure OpenAI Assistants API has been retired. Live
requests now return HTTP 410 (`assistants_api_deprecated`) on Azure
OpenAI and HTTP 404 on OpenAI, so these tests cannot exercise a
functioning service.
- all 30 parametrized cases in
`tests/integration/agents/openai_assistant_agent/test_openai_assistant_agent_integration.py`
are skipped at module level, before the live-service fixture runs
- the `step1_openai_assistant` case in `tests/samples/test_concepts.py`
is skipped unconditionally
- the other concept samples are unchanged
- all 103 tests under `tests/unit/agents/openai_assistant` remain
enabled and passing
The skips are intentionally limited to live tests for the retired API.
Comments next to each skip include the migration guide and state that
the skip should be removed after the agents and sample move to the
replacement API.
## Validation
- uv lock consistency checks
- 35 Hugging Face unit tests pass
- all 12 deliberate connector mutations used to assess regression
coverage were detected by the unit tests
- all 103 Assistants agent unit tests pass
- 30 live Assistants integration cases and the one retired-API concept
sample report as skipped before making service requests
- the three text completion services used by the integration suite were
exercised against their real models on Transformers 5, for both
completion and streaming
- Ruff check and formatting pass
---------
Co-authored-by: Evan Mattson <[email protected]>
Co-authored-by: Copilot App <[email protected]>
Copilot-Session: c2d4dd29-0a9c-4f43-b2ce-243e19ec34b2
### Motivation and Context
The OpenAI Assistants API has been retired. The .NET integration
pipeline now receives `HTTP 410 (assistants_api_deprecated)` from Azure
OpenAI, causing 43 agent integration test failures.
Failing job:
https://github.com/microsoft/semantic-kernel/actions/runs/33497308634/job/99822416385
### Description
- Remove the retired OpenAI Assistant agent integration tests and their
shared fixture.
- Remove mixed-agent integration tests that depend on the Assistants
API.
- Keep Chat Completion and Aggregator agent tests using their own
classes as user-secrets assembly markers.
The production Assistants implementation is intentionally unchanged and
can be removed separately.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 6c360f47-9139-42f1-9dca-4b8ab68f7a53
### Motivation and Context
Keep the MCP OAuth demo aligned with the current Semantic Kernel Python
SDK release and public API signatures.
### Description
- Update the sample's Semantic Kernel dependency to 1.44.1.
- Refresh the lockfile for the updated dependency graph.
- Align timeout and agent-thread type annotations with the current SDK
APIs.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All applicable checks pass; no new unit tests are needed for this
sample dependency update
- [x] I didn't break anyone 😄
---------
Copilot-Session: 71b0555a-bf39-4b88-8ff9-9a1178453c1b
~CFS users will get dependencies restoration issues in dotnet unless
they remove the nuget.config locally. This pull request documents that
so they get unstuck~
after further discussions, this only carries the default configuration
any dotnet user should have. And it's problematic for CFS users. So
we'll simply remove the nuget.config file.
Co-authored-by: SergeyMenshykh <[email protected]>
This updates all the OpenAPI related dependencies since
Microsoft.OpenAPI has released numerous patches.
---------
Signed-off-by: Vincent Biret <[email protected]>
Co-authored-by: SergeyMenshykh <[email protected]>
## Summary
This PR pins GitHub Actions to full-length commit SHAs for improved
security and reproducibility and adds a 7 day cooldown to Dependabot
configuration for GitHub Actions. This work is described in more detail
at https://aka.ms/action-pinning.
## Why?
Pinning actions to commit SHAs prevents supply-chain attacks where a tag
could be moved to point to malicious code. This is a recommended
security best practice per the [GitHub Actions security hardening
guide](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions).
This change mitigates the risk of tag retargeting to malicious code as
seen in incidents like the [tj-actions/changed-files action
compromise](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised)
or [codfish/semantic-release-action
compromise](https://www.stepsecurity.io/blog/supply-chain-compromise-codfish-semantic-release-action)
and improves the integrity and reproducibility of the CI/CD pipeline.
## What changed?
**Action pinning:** Third-party action references in
`.github/workflows/` that used mutable tag-based references (e.g.,
`actions/checkout@v4`) have been updated to full-length commit SHAs with
a version comment (e.g., `actions/checkout@<sha> # v4`) using the
[pinact](https://github.com/suzuki-shunsuke/pinact) tool. References
that were already pinned to a SHA, or that used immutable release tags,
were left unchanged.
**Dependabot configuration:** `.github/dependabot.yml` has been updated
to ensure a `github-actions` package-ecosystem section is present with a
`cooldown` configuration (`default-days: 7`). If the file did not exist,
it was created. If a `github-actions` section already existed, only the
`cooldown` block was added or its `default-days` value was increased to
7 if it was lower. The 7-day cooldown provides a window for the
community to detect and report compromised releases before they are
automatically proposed as updates, reducing exposure to supply-chain
attacks via newly published malicious versions.
## Is this safe to merge?
Yes. The pinned SHAs correspond to the same commits that the existing
tags pointed to. No behavioral changes in action execution are
introduced. You can verify the pinned SHA value using the GitHub REST
API (e.g., the commit hash for `actions/checkout@v7` can be found in the
`sha` property in the JSON response for `GET
https://api.github.com/repos/actions/checkout/commits/v7`).
## Additional Information
For more information, please see https://aka.ms/action-pinning
Co-authored-by: westey <[email protected]>
### Motivation and Context
The model used by this test is deprecated and the test is blocking
merges.
### Description
Switch to replacement model
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
The Copilot Studio agent exposed a `SERVICE` authentication mode that
was never reachable — it was guarded to always raise before its
implementation ran. Its dormant credential handling also triggered
certificate-related static analysis alerts.
### Description
Removes the service authentication path along with its settings,
parameters, tests, and documentation. `CopilotStudioAgentAuthMode` is
kept with its `INTERACTIVE` member, which is the only supported mode.
Interactive authentication is unchanged.
Service authentication can be reintroduced later as a complete, tested
feature.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
---------
Copilot-Session: 25dd6e2a-f759-4148-a630-40110e90eff2
### Motivation and Context
Resolves the SSH.NET high-severity vulnerability reported by NuGet
auditing.
### Description
Updates Testcontainers.Milvus and Testcontainers.MongoDB to 4.14.0,
which uses the patched SSH.NET 2026.0.0 dependency.
### Contribution Checklist
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
Copilot-Session: 26c910de-c080-4e3e-909f-3d84769b6654
## Motivation and Context
The Gemini connector converts a `FunctionChoiceBehavior` (FCB) into the
connector-internal `GeminiToolCallBehavior` in
`GeminiPromptExecutionSettings`. That conversion only inspected the
`AutoInvoke` flag and evaluated the behavior against an empty kernel, so
the configured function list and choice were dropped:
- `FunctionChoiceBehavior.Auto()` / `Auto([subset])` always provided
**all** kernel functions to the model, regardless of the list supplied.
- `FunctionChoiceBehavior.Auto([])`, which is documented as equivalent
to disabling function calling, still provided all kernel functions.
- Explicit function lists failed to convert because the behavior was
evaluated against an empty kernel.
This diverges from the other connectors, which resolve the behavior
against the request kernel and provide exactly the functions it
specifies.
## Description
- Resolve the `FunctionChoiceBehavior` against the request's kernel and
provide exactly the functions it declares (all, an explicit subset, or
none), matching the shared function-calling semantics used by the other
connectors.
- An empty function list now correctly disables function calling.
- Perform the conversion on a clone so shared or frozen settings
instances are not mutated and the resolved result is not cached across
different kernels.
- Add a kernel-aware `FromExecutionSettings(settings, kernel)` overload
and use it from `GeminiChatCompletionClient`.
## Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
---------
Co-authored-by: Copilot <[email protected]>
Copilot-Session: c0e4edcd-4d36-486f-950b-9c0c36fa68e8
Updated
[CommunityToolkit.VectorData.InMemory](https://github.com/CommunityToolkit/AI)
from 1.0.0 to 1.0.1.
<details>
<summary>Release notes</summary>
_Sourced from [CommunityToolkit.VectorData.InMemory's
releases](https://github.com/CommunityToolkit/AI/releases)._
No release notes found for this version range.
Commits viewable in [compare
view](https://github.com/CommunityToolkit/AI/commits).
</details>
Updated [System.Numerics.Tensors](https://github.com/dotnet/dotnet) from
10.0.9 to 10.0.10.
<details>
<summary>Release notes</summary>
_Sourced from [System.Numerics.Tensors's
releases](https://github.com/dotnet/dotnet/releases)._
No release notes found for this version range.
Commits viewable in [compare
view](https://github.com/dotnet/dotnet/commits).
</details>
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
### Motivation and Context
All .NET MEVD vector store providers have been migrated to the
[CommunityToolkit/AI
repository](https://github.com/CommunityToolkit/AI). This removes the
now-redundant source code and tests from this repo and leaves
discoverable redirects in their place.
### Description
**Removed source + tests** for 12 providers (Chroma and Milvus kept
unchanged):
- **AzureAISearch, CosmosMongoDB, CosmosNoSql, InMemory, PgVector,
Qdrant, Redis, SqlServer, SqliteVec, Weaviate** → moved to
[CommunityToolkit/AI/MEVD/src/](https://github.com/CommunityToolkit/AI/tree/main/MEVD/src)
- **MongoDB** → moved to
[mongodb/mongo-mevd-provider](https://github.com/mongodb/mongo-mevd-provider)
- **Pinecone** → removed; Pinecone archived their [.NET
SDK](https://github.com/pinecone-io/pinecone-dotnet-client), no longer
supported
- **Common** → removed (was only shared by SqlServer/SqliteVec/PgVector,
all gone)
**Added `README.md`** in each removed provider directory pointing to the
new upstream location (or explaining Pinecone deprecation).
**Removed all associated test projects** including the shared
`VectorData.ConformanceTests` infrastructure (no remaining consumers
after provider removal).
**Updated `dotnet/MEVD.slnx`** — now contains only Chroma and Milvus.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
---------
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
### Motivation and Context
Bump Python version to 1.44.1 for a release
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump Python version to 1.44.1 for a release
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [X] I didn't break anyone 😄
### Motivation and Context
Prepares the .NET packages for the next minor release.
### Description
- Bumps `VersionPrefix` from `1.78.0` to `1.79.0`.
- Advances `PackageValidationBaselineVersion` from `1.77.0` to `1.78.0`.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
Copilot-Session: 2a1e876a-251c-403d-bc89-8e02610a19ae
### Motivation and Context
`_CopilotStudioAgentTokenFactory._cert_thumbprint` computes the X.509
certificate thumbprint that is passed to MSAL as the `thumbprint` client
credential. This value is the JWT `x5t` header, which MSAL and Microsoft
Entra ID require to be a SHA-1 digest - any other digest would be
rejected by the token endpoint.
Because it is a plain digest call, static analysis tooling flags it even
though the hash is used purely as a certificate identifier, not as a
cryptographic/security primitive (the call already passes
`usedforsecurity=False`).
### Description
Adds a comment explaining why SHA-1 is required here and annotates the
call so static analysis does not flag it. No behavior change.
Note: MSAL itself carries the same annotation on its own `x5t`
fingerprint computation.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
---------
Co-authored-by: Copilot App <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
Copilot-Session: d2b7d3e7-a125-4569-b976-a6534c1837ae
Bumps the pinned .NET SDK version in `dotnet/global.json` from 10.0.301
to the patched 10.0.302 release to mitigate a security vulnerability in
older 10.0 SDKs. Version-only change; no functional impact. See
https://aka.ms/dotnet-security-notes for details.
Co-authored-by: Copilot <[email protected]>
Copilot-Session: 3905f237-3424-4ddd-93e4-47c05dd840ce
