microsoft/semantic-kernel
1
0
Fork 0
mirror of https://github.com/microsoft/semantic-kernel.git synced 2026-10-12 11:19:56 +00:00
Code Issues Packages Projects Releases Wiki Activity
5,101 Commits 64 Branches 1,077 Tags
main
Commit Graph
2641 Commits
Author SHA1 Message Date
SergeyMenshykhandCopilot App 11f072362e .Net: Improve OpenAPI HTTP connection handling (#14570) 
### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

Improve consistency of the built-in OpenAPI HTTP client while preserving
request identity and existing customization points.

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

Refine connection handling and internal validation-result propagation.
Preserve caller-supplied clients and existing redirect behavior. Add
regression coverage for connection selection, pooling, and HTTPS
behavior.

---------

Co-authored-by: Copilot App <[email protected]>
 2026-10-09 18:00:19 +00:00
Roger Barreto cc8a15fa35 .Net: Bound element nesting depth in XML prompt parsing (#14504) 
## Motivation and Context

`XmlPromptParser` converts chat prompts such as `<message
role="user">...</message>` into `PromptNode` trees that
`ChatPromptParser` turns into a `ChatHistory`. Each `PromptNode` stores
the serialized inner XML of its element, so the parser re-serializes and
decodes the whole remaining subtree at every nesting level. Parse work
therefore grows with nesting depth multiplied by prompt size, and the
recursive node builder had no depth bound.

Supported chat prompt structure is shallow: message elements with
optional `text`, `image`, `audio`, and `binary` children, plus encoded
or CDATA text. This change bounds element nesting so parsing cost stays
proportional to prompt size.

## Description

- Add `XmlPromptParser.MaxElementDepth` (internal, `64`, top-level
prompt elements count as depth 1, matching the `System.Text.Json`
default maximum depth).
- After the prompt is loaded and before any `PromptNode` is built, a
single non-recursive walk checks element depth. Prompts nested deeper
than the limit return `false` from `TryParse`.
- A rejected prompt takes the existing invalid-XML path: callers such as
`GetChatMessageContentsAsync(string)` send the whole prompt as one user
text message, exactly as they already do for malformed XML.
- Parse work for accepted prompts is bounded by the depth limit times
prompt size, and recursion in `GetPromptNode` is bounded.
- No public API change. Prompts within the limit, including content
items, CDATA, and encoded content, parse exactly as before.

Tests:

- `XmlPromptParserTests`: parses two prompts at exactly the maximum
depth; rejects one level over and far over the limit; rejects when only
a later top-level node exceeds the limit (covers sibling traversal after
a max-depth subtree).
- `ChatPromptParserTests`: a user message whose content exceeds the
limit makes `ChatPromptParser.TryParse` return `false`.

## Validation

All local runs use `-c Debug` on .NET SDK 10.0.401.

- Build with `--warnaserror`: `SemanticKernel.Abstractions` (`net10.0`,
`net8.0`, `netstandard2.0`), `SemanticKernel.UnitTests`,
`Extensions.UnitTests`, `PromptTemplates.Liquid.UnitTests`,
`Agents.UnitTests`, `IntegrationTests`: 0 warnings, 0 errors.
- `dotnet format --verify-no-changes` in
`mcr.microsoft.com/dotnet/sdk:10.0` for both changed projects: clean.
- `SemanticKernel.UnitTests`: 1614/1614 pass, including the 5 new tests.
The new over-limit tests fail without the parser change.
- `Extensions.UnitTests` (Handlebars) 90/90,
`PromptTemplates.Liquid.UnitTests` 16/16, `Agents.UnitTests` 504/504
executed tests pass, `IntegrationTests` CrossLanguage (offline, stubbed
HTTP request shape) 37/37.
- Normal chat prompts produce the same `ChatHistory` on `net10.0`,
`net8.0`, and .NET Framework 4.8 (`netstandard2.0` asset), and the
largest prompts still accepted parse in time proportional to their size.

## Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
 2026-10-07 08:17:44 +00:00
SergeyMenshykhandCopilot App bd3150d9a2 .Net: Bump package version to 1.81.0 (#14553) 
### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

Prepares the .NET packages for the next minor release.

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

- Bumps the shared `VersionPrefix` from `1.80.1` to `1.81.0`.
- Advances `PackageValidationBaselineVersion` from `1.80.0` to `1.80.1`.

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [x] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄

Co-authored-by: Copilot App <[email protected]>
 2026-10-06 11:55:12 +00:00
SergeyMenshykhandCopilot App 141359393d Python: .NET/Python: Validate CrewAI task identifiers (#14551) 
### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

Align CrewAI task identifier handling across the .NET and Python clients
and fail early for unsupported identifier formats.

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

- Validate CrewAI status task identifiers consistently in both
implementations.
- Add focused unit coverage for accepted and rejected identifier
formats.
- Preserve valid identifiers unchanged in outgoing status requests.

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [x] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄

---------

Co-authored-by: Copilot App <[email protected]>
 2026-10-06 11:39:59 +00:00
SergeyMenshykhandCopilot App 71b2193130 Python: .NET/Python: Share HTTP request validation utilities (#14546) 
### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

Improve consistency and maintainability of HTTP request validation in
the .NET and Python SDKs.

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

- Extract existing request validation into shared internal utilities and
reuse them in the HTTP plugins.
- Update HTTP plugin configuration and documentation.
- Extend unit coverage for shared validation and plugin behavior.

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [x] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄

---------

Co-authored-by: Copilot App <[email protected]>
 2026-10-06 10:08:03 +00:00
SergeyMenshykhandCopilot App a205c428ee .Net: Update file handling for FileIOPlugin (#14525) 
### Motivation and Context

Ensure `FileIOPlugin` applies its configured access rules consistently
and provides predictable error responses. This improves reliability for
applications exposing file operations through kernel functions.

### Description

Refines `FileIOPlugin` path validation and error handling while
preserving its public API and configured folder restrictions. Adds
regression coverage for both default and explicitly configured settings,
including consistent error responses and continued enforcement of
file-access rules.

---------

Co-authored-by: Copilot App <[email protected]>
 2026-10-05 09:39:41 +00:00
westey 58ad1a3780 .Net: Improve Milvus filtering (#14498) 
### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

### Description

Improve Milvus filtering to allow more id types to be supported

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
 2026-09-30 18:11:20 +00:00
SergeyMenshykhandCopilot App 082700e24b .Net: Align plugin path validation (#14476) 
Align path validation behavior across plugins and add regression
coverage.

Co-authored-by: Copilot App <[email protected]>
 2026-09-30 17:47:33 +00:00
SergeyMenshykhandCopilot App c7ba1af5df .Net: Temporarily skip direct OpenAI integration tests (#14507) 
### Motivation and Context

The .NET integration job in
https://github.com/microsoft/semantic-kernel/actions/runs/36585640900/job/109465158271
failed on direct OpenAI API calls because the configured key was
rejected (401) and the account had exhausted its credits (429).
Temporarily pause those cases while credentials and billing are
restored; Azure OpenAI failures are separate and are not addressed here.

### Description

- Skip direct OpenAI connector tests in code with an explicit temporary
reason.
- Skip only the OpenAI-backed data rows of response-agent tests; retain
Azure-backed rows.
- Temporarily disable the OpenAI response-agent conformance classes that
require the direct API. Keep their imports and declarations available
for re-enabling.
- Leave the integration-test workflow unchanged.

Focused validation: the integration-test project compiled, and the
selected OpenAI test cases reported 12 skipped, 0 failed. Azure OpenAI
service errors from the original run can still cause the job to fail.

### Contribution Checklist

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄

---------

Co-authored-by: Copilot App <[email protected]>
 2026-09-30 16:47:09 +00:00
SergeyMenshykhandCopilot App bb601cc093 .NET: Upgrade Git build dependency (#14477) 
Upgrade Microsoft.SourceLink.GitHub to 10.0.303 so its transitive
Microsoft.Build.Tasks.Git dependency uses the patched release.

Co-authored-by: Copilot App <[email protected]>
 2026-09-28 18:47:56 +01:00
westey 872d29ea75 SessionsPythonPlugin bug fix (#14374) 
### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
 2026-09-07 17:16:58 +00:00
Evan Mattsondependabot[bot]copilot-swe-agent[bot]rogerbarretoCopilot
 		ebc2ef9bb2 Consolidate Dependabot dependency updates (#14385) 
### Motivation and Context

Consolidates the currently open Dependabot updates into one reviewable
dependency PR while preserving each source update's intent across GitHub
Actions, .NET, Python, and JavaScript sample dependencies.

### Description

Updates pinned GitHub Actions, central NuGet package versions, Python
dependency constraints and uv lockfiles, and npm/Yarn lockfiles for the
affected samples. Overlapping lockfile updates were regenerated or
reconciled so that all compatible requested versions are retained
together on the latest `main`. The incompatible MCP 2.x and Python 3.10
`onnxruntime-genai` updates are excluded, the private-feed-only
`@humanfs/node` update is omitted, and the logging abstractions floor is
aligned with the updated Azure AI Projects dependency.

### Related Issue

Supersedes:
- https://github.com/microsoft/semantic-kernel/pull/14177
- https://github.com/microsoft/semantic-kernel/pull/14179
- https://github.com/microsoft/semantic-kernel/pull/14180
- https://github.com/microsoft/semantic-kernel/pull/14190
- https://github.com/microsoft/semantic-kernel/pull/14209
- https://github.com/microsoft/semantic-kernel/pull/14230
- https://github.com/microsoft/semantic-kernel/pull/14233
- https://github.com/microsoft/semantic-kernel/pull/14254
- https://github.com/microsoft/semantic-kernel/pull/14257
- https://github.com/microsoft/semantic-kernel/pull/14259
- https://github.com/microsoft/semantic-kernel/pull/14260
- https://github.com/microsoft/semantic-kernel/pull/14261
- https://github.com/microsoft/semantic-kernel/pull/14271
- https://github.com/microsoft/semantic-kernel/pull/14272
- https://github.com/microsoft/semantic-kernel/pull/14273
- https://github.com/microsoft/semantic-kernel/pull/14274
- https://github.com/microsoft/semantic-kernel/pull/14276
- https://github.com/microsoft/semantic-kernel/pull/14280
- https://github.com/microsoft/semantic-kernel/pull/14282
- https://github.com/microsoft/semantic-kernel/pull/14299
- https://github.com/microsoft/semantic-kernel/pull/14300
- https://github.com/microsoft/semantic-kernel/pull/14335
- https://github.com/microsoft/semantic-kernel/pull/14337
- https://github.com/microsoft/semantic-kernel/pull/14338
- https://github.com/microsoft/semantic-kernel/pull/14339
- https://github.com/microsoft/semantic-kernel/pull/14357
- https://github.com/microsoft/semantic-kernel/pull/14358
- https://github.com/microsoft/semantic-kernel/pull/14361
- https://github.com/microsoft/semantic-kernel/pull/14365
- https://github.com/microsoft/semantic-kernel/pull/14366
- https://github.com/microsoft/semantic-kernel/pull/14367
- https://github.com/microsoft/semantic-kernel/pull/14368
- https://github.com/microsoft/semantic-kernel/pull/14369

### Contribution Checklist

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: rogerbarreto <[email protected]>
Co-authored-by: Copilot <[email protected]>
Copilot-Session: d3c2550f-f129-4660-9461-af1288241064
 2026-09-07 09:46:40 +00:00
westey f8c5ba7aec Fix magentic ledger bug (#14372) 
### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
 2026-09-04 10:12:53 +00:00
SergeyMenshykhandCopilot App d8ec449192 .NET: Bump package version to 1.80.1 (#14370) 
## Summary
- bump SK .NET packages from 1.80.0 to 1.80.1
- update the package validation baseline from 1.79.0 to 1.80.0

## Rationale
Changes since dotnet-1.80.0 are maintenance updates without new public
APIs or features, so this is a patch release.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: be9e3ab4-e9ee-4871-8b21-a62c2b732f74
 2026-09-03 16:42:38 +00:00
SergeyMenshykh 3438d88214 .NET: update SDK to 10.0.303 (#14353) 
## Summary
- update the .NET SDK from 10.0.302 to 10.0.303

Copilot-Session: 7700cf8b-af34-40cd-945b-f271edb4c6e3
 2026-09-01 15:03:03 +00:00
SergeyMenshykhandCopilot App 437336175b .NET: Remove retired OpenAI Assistants integration tests (#14354) 
### Motivation and Context

The OpenAI Assistants API has been retired. The .NET integration
pipeline now receives `HTTP 410 (assistants_api_deprecated)` from Azure
OpenAI, causing 43 agent integration test failures.

Failing job:
https://github.com/microsoft/semantic-kernel/actions/runs/33497308634/job/99822416385

### Description

- Remove the retired OpenAI Assistant agent integration tests and their
shared fixture.
- Remove mixed-agent integration tests that depend on the Assistants
API.
- Keep Chat Completion and Aggregator agent tests using their own
classes as user-secrets assembly markers.

The production Assistants implementation is intentionally unchanged and
can be removed separately.

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 6c360f47-9139-42f1-9dca-4b8ab68f7a53
 2026-09-01 13:47:22 +00:00
Vincent BiretandSergeyMenshykh a64827ec8c ci: removes extraneous nuget.config file (#14341) 
~CFS users will get dependencies restoration issues in dotnet unless
they remove the nuget.config locally. This pull request documents that
so they get unstuck~

after further discussions, this only carries the default configuration
any dotnet user should have. And it's problematic for CFS users. So
we'll simply remove the nuget.config file.

Co-authored-by: SergeyMenshykh <[email protected]>
 2026-08-27 17:36:18 +01:00
Vincent BiretandSergeyMenshykh a220003298 chore: bumps the OpenAPI dependencies to the latest versions (#14340) 
This updates all the OpenAPI related dependencies since
Microsoft.OpenAPI has released numerous patches.

---------

Signed-off-by: Vincent Biret <[email protected]>
Co-authored-by: SergeyMenshykh <[email protected]>
 2026-08-27 17:36:02 +01:00
Vincent BiretandCopilot Autofix powered by AI 60264bbdc8 tests: refactors redirection tests to avoid race condition (#14342) 
while working on #14340 I noticed some flaky unit tests are you can see
in
https://github.com/microsoft/semantic-kernel/actions/runs/32982261836/job/98221741513?pr=14340.
This PR refactors the involved tests so they don't run into each other

---------

Co-authored-by: Copilot Autofix powered by AI <[email protected]>
 2026-08-27 17:07:53 +01:00
Vincent BiretandCopilot Autofix powered by AI b4b0ae7780 chore: fixes typos (#14343) 
fixes typos across repo that were flagged by the CI

---------

Co-authored-by: Copilot Autofix powered by AI <[email protected]>
 2026-08-27 17:07:35 +01:00
CopilotadamsitnikAdam Sitnik
 		abf10dd6ea Update CommunityToolkit VectorData package names (#14333) 
### Motivation and Context

CommunityToolkit/AI renamed the Cosmos MongoDB and Cosmos NoSQL
VectorData providers. Semantic Kernel references should point to the
renamed packages and source locations.

### Description

- **README links**
  - Updated Cosmos MongoDB README to `MEVD/src/AzureDocumentDB`
  - Updated Cosmos NoSQL README to `MEVD/src/AzureCosmosDB`

- **Central package versions**
- `CommunityToolkit.VectorData.CosmosMongoDB` →
`CommunityToolkit.VectorData.AzureDocumentDB`
- `CommunityToolkit.VectorData.CosmosNoSql` →
`CommunityToolkit.VectorData.AzureCosmosDB`

- **Sample references**
  - Updated affected sample project package references.
  - Updated renamed extension method call sites:
    - `AddCosmosMongo...` → `AddDocumentDB...`
    - `AddCosmosNoSql...` → `AddCosmos...`

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: adamsitnik <[email protected]>
Co-authored-by: Adam Sitnik <[email protected]>
 2026-08-26 15:47:02 +00:00
westey cd7b533ed1 Switch failing test to new model. (#14332) 
### Motivation and Context

The model used by this test is deprecated and the test is blocking
merges.

### Description

Switch to replacement model

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
 2026-08-26 10:42:58 +00:00
SergeyMenshykh 5e1f1fb87d .NET: Bump package version to 1.80.0 (#14301) 
Bumps .NET packages to 1.80.0 and removes obsolete API compatibility
suppressions.

---------

Copilot-Session: 76473d08-fe9c-4aa1-9b18-c325b1e71672
 2026-08-18 13:50:39 +00:00
SergeyMenshykh 1b7b020cd0 Update OpenAPI HTTP client defaults (#14293) 
Updates OpenAPI HTTP client defaults and related test coverage.

---------

Copilot-Session: da844777-e333-41e3-a18e-76794e1119d9
 2026-08-18 11:18:32 +00:00
SergeyMenshykh c1afc86399 .NET: Bump Testcontainers packages (#14294) 
### Motivation and Context

Resolves the SSH.NET high-severity vulnerability reported by NuGet
auditing.

### Description

Updates Testcontainers.Milvus and Testcontainers.MongoDB to 4.14.0,
which uses the patched SSH.NET 2026.0.0 dependency.

### Contribution Checklist

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄

Copilot-Session: 26c910de-c080-4e3e-909f-3d84769b6654
 2026-08-18 09:12:23 +00:00
Giles OdigweandCopilot c028a0c7dc .Net: Honor FunctionChoiceBehavior function list in Gemini connector (#14183) 
## Motivation and Context

The Gemini connector converts a `FunctionChoiceBehavior` (FCB) into the
connector-internal `GeminiToolCallBehavior` in
`GeminiPromptExecutionSettings`. That conversion only inspected the
`AutoInvoke` flag and evaluated the behavior against an empty kernel, so
the configured function list and choice were dropped:

- `FunctionChoiceBehavior.Auto()` / `Auto([subset])` always provided
**all** kernel functions to the model, regardless of the list supplied.
- `FunctionChoiceBehavior.Auto([])`, which is documented as equivalent
to disabling function calling, still provided all kernel functions.
- Explicit function lists failed to convert because the behavior was
evaluated against an empty kernel.

This diverges from the other connectors, which resolve the behavior
against the request kernel and provide exactly the functions it
specifies.

## Description

- Resolve the `FunctionChoiceBehavior` against the request's kernel and
provide exactly the functions it declares (all, an explicit subset, or
none), matching the shared function-calling semantics used by the other
connectors.
- An empty function list now correctly disables function calling.
- Perform the conversion on a clone so shared or frozen settings
instances are not mutated and the resolved result is not cached across
different kernels.
- Add a kernel-aware `FromExecutionSettings(settings, kernel)` overload
and use it from `GeminiChatCompletionClient`.

## Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄

---------

Co-authored-by: Copilot <[email protected]>
Copilot-Session: c0e4edcd-4d36-486f-950b-9c0c36fa68e8
 2026-08-11 16:50:26 +00:00
dependabot[bot] 1d336b3731 .Net: Bump CommunityToolkit.VectorData.InMemory and System.Numerics.Tensors (#14283) 
Updated
[CommunityToolkit.VectorData.InMemory](https://github.com/CommunityToolkit/AI)
from 1.0.0 to 1.0.1.

<details>
<summary>Release notes</summary>

_Sourced from [CommunityToolkit.VectorData.InMemory's
releases](https://github.com/CommunityToolkit/AI/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/CommunityToolkit/AI/commits).
</details>

Updated [System.Numerics.Tensors](https://github.com/dotnet/dotnet) from
10.0.9 to 10.0.10.

<details>
<summary>Release notes</summary>

_Sourced from [System.Numerics.Tensors's
releases](https://github.com/dotnet/dotnet/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/dotnet/dotnet/commits).
</details>

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-11 10:40:32 +00:00
Copilot 76b54649d6 remove migrated .NET MEVD providers, add redirect READMEs (#14193) 
### Motivation and Context

All .NET MEVD vector store providers have been migrated to the
[CommunityToolkit/AI
repository](https://github.com/CommunityToolkit/AI). This removes the
now-redundant source code and tests from this repo and leaves
discoverable redirects in their place.

### Description

**Removed source + tests** for 12 providers (Chroma and Milvus kept
unchanged):
- **AzureAISearch, CosmosMongoDB, CosmosNoSql, InMemory, PgVector,
Qdrant, Redis, SqlServer, SqliteVec, Weaviate** → moved to
[CommunityToolkit/AI/MEVD/src/](https://github.com/CommunityToolkit/AI/tree/main/MEVD/src)
- **MongoDB** → moved to
[mongodb/mongo-mevd-provider](https://github.com/mongodb/mongo-mevd-provider)
- **Pinecone** → removed; Pinecone archived their [.NET
SDK](https://github.com/pinecone-io/pinecone-dotnet-client), no longer
supported
- **Common** → removed (was only shared by SqlServer/SqliteVec/PgVector,
all gone)

**Added `README.md`** in each removed provider directory pointing to the
new upstream location (or explaining Pinecone deprecation).

**Removed all associated test projects** including the shared
`VectorData.ConformanceTests` infrastructure (no remaining consumers
after provider removal).

**Updated `dotnet/MEVD.slnx`** — now contains only Chroma and Milvus.

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
 2026-08-10 13:47:26 +00:00
SergeyMenshykh fb137812c7 .NET: Bump package version to 1.79.0 (#14275) 
### Motivation and Context

Prepares the .NET packages for the next minor release.

### Description

- Bumps `VersionPrefix` from `1.78.0` to `1.79.0`.
- Advances `PackageValidationBaselineVersion` from `1.77.0` to `1.78.0`.

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄

Copilot-Session: 2a1e876a-251c-403d-bc89-8e02610a19ae
 2026-08-05 18:47:37 +00:00
Giles OdigweandCopilot 383d102346 Bump .NET SDK from 10.0.301 to 10.0.302 (#14235) 
Bumps the pinned .NET SDK version in `dotnet/global.json` from 10.0.301
to the patched 10.0.302 release to mitigate a security vulnerability in
older 10.0 SDKs. Version-only change; no functional impact. See
https://aka.ms/dotnet-security-notes for details.

Co-authored-by: Copilot <[email protected]>
Copilot-Session: 3905f237-3424-4ddd-93e4-47c05dd840ce
 2026-07-30 19:03:16 +00:00
Giles Odigwe 362cc2bad7 Bump form-data from 4.0.5 to 4.0.6 in ProcessFrameworkWithSignalR React frontend (#14234) 
Bumps the transitively-resolved form-data dependency from 4.0.5 to the
patched 4.0.6 in the ProcessFrameworkWithSignalR React frontend.
Lock-file only change; no functional impact.

---------

Copilot-Session: fdaae27a-1dfe-4ed4-9704-c4b8f6c7ecd7
 2026-07-30 19:01:21 +00:00
Evan Mattson 7d885ddac1 Consolidate Python and .NET dependency updates (#14222) 
### Motivation and Context

Consolidates the currently open Python and .NET Dependabot updates into
one coordinated dependency change. This reduces duplicate review and CI
work while preserving each source PR's update intent.

The npm and Yarn updates are intentionally excluded from this draft and
remain in their original Dependabot PRs.

### Related Issue

Supersedes:

- https://github.com/microsoft/semantic-kernel/pull/14178
- https://github.com/microsoft/semantic-kernel/pull/14184
- https://github.com/microsoft/semantic-kernel/pull/14185
- https://github.com/microsoft/semantic-kernel/pull/14186
- https://github.com/microsoft/semantic-kernel/pull/14187
- https://github.com/microsoft/semantic-kernel/pull/14188
- https://github.com/microsoft/semantic-kernel/pull/14189
- https://github.com/microsoft/semantic-kernel/pull/14191
- https://github.com/microsoft/semantic-kernel/pull/14192
- https://github.com/microsoft/semantic-kernel/pull/14202
- https://github.com/microsoft/semantic-kernel/pull/14203
- https://github.com/microsoft/semantic-kernel/pull/14204
- https://github.com/microsoft/semantic-kernel/pull/14205
- https://github.com/microsoft/semantic-kernel/pull/14207
- https://github.com/microsoft/semantic-kernel/pull/14208
- https://github.com/microsoft/semantic-kernel/pull/14211
- https://github.com/microsoft/semantic-kernel/pull/14212
- https://github.com/microsoft/semantic-kernel/pull/14213
- https://github.com/microsoft/semantic-kernel/pull/14214
- https://github.com/microsoft/semantic-kernel/pull/14215
- https://github.com/microsoft/semantic-kernel/pull/14216
- https://github.com/microsoft/semantic-kernel/pull/14217
- https://github.com/microsoft/semantic-kernel/pull/14218
- https://github.com/microsoft/semantic-kernel/pull/14219
- https://github.com/microsoft/semantic-kernel/pull/14221

### Description

- Updates the selected .NET Aspire and AWS SDK package versions in
central package management.
- Updates the selected Python requirements and regenerates both affected
uv lockfiles without losing earlier bumps.
- Keeps the compatible ONNX Runtime/GenAI pair on Python 3.10 while
applying ONNX Runtime GenAI 0.14.1 on Python 3.11 and newer.
- Retains pyOpenSSL 26.2.0, which is newer than the 26.0.0 requested by
its source PR and is required by the consolidated cryptography update.
- Uses Pinecone 7.3 or newer on Windows, where Pinecone 7.0.1 imports
the unavailable Unix `readline` module, while retaining the existing
`~=7.0` range on macOS and Linux.
- Constrains MCP to the compatible 1.x API because the current Semantic
Kernel integration imports interfaces removed by MCP 2.0.

### Validation

- Python unit tests passed across Python 3.10-3.13 on Ubuntu, Windows,
and macOS, including Dapr jobs.
- Python pre-commit, lock validation, spell checking, and
integration-test aggregate checks passed.
- .NET 9/10 builds, package-install checks, unit tests, AOT tests,
formatting, and coverage checks passed on Ubuntu and Windows.
- Merge Gatekeeper passed.

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
 2026-07-29 10:27:10 +00:00
SergeyMenshykhandCopilot App e78a8f503b Suppress CodeQL false positive in internal HTTP utility (#14223) 
Adds an inline CodeQL suppression comment for a confirmed false positive
in an internal HTTP utility method. Input validation is handled by
callers higher in the stack.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 5830be01-63d3-41f6-ae70-8ffeae81d46f
 2026-07-28 15:34:58 +00:00
SergeyMenshykhandCopilot App 441ac99479 Update Microsoft.AspNetCore.OData to 9.5.0 (#14224) 
Pin `Microsoft.AspNetCore.OData` to version 9.5.0 in
`Directory.Packages.props`. This overrides the transitive dependency
brought in by `OData2Linq 2.2.0` used in the Entity Framework structured
data plugin.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: a8efdd59-6d18-4194-8561-1d4144f87333
 2026-07-28 15:23:02 +00:00
CopilotandAdam Sitnik 61a6b0c5fa Migrate VectorStoreRAG and Concepts samples to CommunityToolkit.VectorData packages (#14170) 
### Motivation and Context

`Microsoft.SemanticKernel.Connectors.*` vector store packages are moving
to `CommunityToolkit.VectorData.*`. This updates the `VectorStoreRAG`
and `Concepts` sample projects to reference the new package IDs and
namespaces.

### Description

**Package reference updates** (`Directory.Packages.props`,
`VectorStoreRAG.csproj`, `Concepts.csproj`):

| Old | New | Version |
|-----|-----|---------|
| `Microsoft.SemanticKernel.Connectors.AzureAISearch` |
`CommunityToolkit.VectorData.AzureAISearch` | 1.0.0 |
| `Microsoft.SemanticKernel.Connectors.CosmosMongoDB` |
`CommunityToolkit.VectorData.CosmosMongoDB` | 1.0.0 |
| `Microsoft.SemanticKernel.Connectors.CosmosNoSql` |
`CommunityToolkit.VectorData.CosmosNoSql` | 1.0.0 |
| `Microsoft.SemanticKernel.Connectors.InMemory` |
`CommunityToolkit.VectorData.InMemory` | 1.0.0 |
| `Microsoft.SemanticKernel.Connectors.PgVector` |
`CommunityToolkit.VectorData.PgVector` | 1.0.0 |
| `Microsoft.SemanticKernel.Connectors.Qdrant` |
`CommunityToolkit.VectorData.Qdrant` | 1.0.0 |
| `Microsoft.SemanticKernel.Connectors.Redis` |
`CommunityToolkit.VectorData.Redis` | 1.0.0 |
| `Microsoft.SemanticKernel.Connectors.Weaviate` |
`CommunityToolkit.VectorData.Weaviate` | 1.0.0 |

**Namespace updates** :
```csharp
// Before
using Microsoft.SemanticKernel.Connectors.InMemory;
// After
using CommunityToolkit.VectorData.InMemory;
```

DI extension methods (`AddInMemoryVectorStore`, `AddQdrantCollection`,
etc.) moved to `Microsoft.Extensions.DependencyInjection` in the CT
packages — all affected files already had that `using`, so no additional
changes needed there.

**API compatibility fixes:**
- `[VectorStoreVector(Dimensions: N)]` → `[VectorStoreVector(N)]` in two
files — the new `Microsoft.Extensions.VectorData.Abstractions`
constructor uses a positional parameter named `dimensions` (lowercase),
so the old named-argument form no longer compiles.
- `SharpCompress` pin bumped `0.48.0` → `0.48.1` in
`Directory.Packages.props` — `CommunityToolkit.VectorData.CosmosMongoDB`
pulls `MongoDB.Driver 3.10.0` which requires `>= 0.48.1`.
- Added
`<AzureCosmosDisableNewtonsoftJsonCheck>true</AzureCosmosDisableNewtonsoftJsonCheck>`
to both sample csproj files — `CommunityToolkit.VectorData.CosmosNoSql`
pulls `Microsoft.Azure.Cosmos 3.61.0` which added a mandatory
Newtonsoft.Json explicit-reference check not present in the prior
version.

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: Adam Sitnik <[email protected]>
 2026-07-24 17:10:39 +00:00
Evan Mattsondependabot[bot]copilot-swe-agent[bot]
 		d003eb2590 Consolidate Dependabot dependency updates (#14176) 
### Motivation and Context

Semantic Kernel currently has 43 open Dependabot pull requests spanning
GitHub Actions, .NET, Python, npm, and Yarn dependency graphs. This
rollup applies their compatible net changes together on the latest
`main`, making it possible to validate and merge the updates as one
coherent dependency state.

Supersedes:

- https://github.com/microsoft/semantic-kernel/pull/13133
- https://github.com/microsoft/semantic-kernel/pull/13134
- https://github.com/microsoft/semantic-kernel/pull/13136
- https://github.com/microsoft/semantic-kernel/pull/13172
- https://github.com/microsoft/semantic-kernel/pull/13507
- https://github.com/microsoft/semantic-kernel/pull/13601
- https://github.com/microsoft/semantic-kernel/pull/13606
- https://github.com/microsoft/semantic-kernel/pull/13666
- https://github.com/microsoft/semantic-kernel/pull/13673
- https://github.com/microsoft/semantic-kernel/pull/13688
- https://github.com/microsoft/semantic-kernel/pull/13700
- https://github.com/microsoft/semantic-kernel/pull/13707
- https://github.com/microsoft/semantic-kernel/pull/13708
- https://github.com/microsoft/semantic-kernel/pull/13712
- https://github.com/microsoft/semantic-kernel/pull/13721
- https://github.com/microsoft/semantic-kernel/pull/13873
- https://github.com/microsoft/semantic-kernel/pull/13930
- https://github.com/microsoft/semantic-kernel/pull/13939
- https://github.com/microsoft/semantic-kernel/pull/13949
- https://github.com/microsoft/semantic-kernel/pull/13950
- https://github.com/microsoft/semantic-kernel/pull/13951
- https://github.com/microsoft/semantic-kernel/pull/13997
- https://github.com/microsoft/semantic-kernel/pull/14000
- https://github.com/microsoft/semantic-kernel/pull/14053
- https://github.com/microsoft/semantic-kernel/pull/14069
- https://github.com/microsoft/semantic-kernel/pull/14088
- https://github.com/microsoft/semantic-kernel/pull/14091
- https://github.com/microsoft/semantic-kernel/pull/14094
- https://github.com/microsoft/semantic-kernel/pull/14103
- https://github.com/microsoft/semantic-kernel/pull/14106
- https://github.com/microsoft/semantic-kernel/pull/14107
- https://github.com/microsoft/semantic-kernel/pull/14108
- https://github.com/microsoft/semantic-kernel/pull/14109
- https://github.com/microsoft/semantic-kernel/pull/14110
- https://github.com/microsoft/semantic-kernel/pull/14128
- https://github.com/microsoft/semantic-kernel/pull/14148
- https://github.com/microsoft/semantic-kernel/pull/14149
- https://github.com/microsoft/semantic-kernel/pull/14160
- https://github.com/microsoft/semantic-kernel/pull/14161
- https://github.com/microsoft/semantic-kernel/pull/14164
- https://github.com/microsoft/semantic-kernel/pull/14171
- https://github.com/microsoft/semantic-kernel/pull/14172
- https://github.com/microsoft/semantic-kernel/pull/14173

### Description

- Updates the requested GitHub Actions and preserves the PR-file-scoped
typos workflow fix.
- Consolidates the .NET Aspire, AWS SDK, ReportGenerator, JavaScript,
and SQLite security updates.
- Regenerates the npm, Yarn, and uv lockfiles from the combined
manifests instead of resolving generated-file conflicts by selection.
- Rolls overlapping updates forward to one compatible result: pyasn1
0.6.4 supersedes 0.6.3; pyOpenSSL 26.2.0 remains compatible with
cryptography 48.0.1; and Vite 8/Rolldown makes the older Rollup-only
overrides obsolete.
- Retains updates already present on current `main` without
reintroducing stale pins, including Aspire Hosting Azure Search 13.3.0
and Prompty.Core 2.0.0-beta.3.

The full .NET solution builds in Debug with zero warnings and errors.
Focused validation passed 82 .NET tests (3 skipped), 1,096 Python tests,
both frontend production builds, and uv lock consistency checks for the
main Python project and OAuth sample.

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
 2026-07-23 08:29:36 +00:00
Gaurav MittalClaude Sonnet 4.6westey
 		acb3e35c54 .Net: [.NET] Add TimeProvider injection to TimePlugin for deterministic testing (#14112) 
Closes #14111

## Summary

- Adds a `TimeProvider` constructor parameter to `TimePlugin` (defaults
to `TimeProvider.System`, so all existing callers are unaffected)
- Replaces all direct `DateTimeOffset.Now` / `DateTimeOffset.UtcNow`
calls with `_timeProvider.GetLocalNow()` / `_timeProvider.GetUtcNow()`
- Rewrites `TimePluginTests` from 5 real-clock tests to 26 deterministic
tests covering every public method, using an inline
`FixedUtcTimeProvider` subclass (no new test dependencies)

## Key decisions

| Decision | Reason |
|---|---|
| `System.TimeProvider` (not a custom `IClock`) | Standard .NET 8+
pattern; no extra abstraction needed |
| Inline `FixedUtcTimeProvider` subclass in tests | Avoids adding
`Microsoft.Extensions.TimeProvider.Testing` as a new dependency; 3-line
subclass is clearer |
| `LocalTimeZone = TimeZoneInfo.Utc` on the test provider | Makes test
output identical on any machine regardless of OS timezone |
| Default `TimeProvider.System` in constructor | Zero breaking change —
all existing callers (`new TimePlugin()`) work unchanged |

## Test results

```
Passed! - Failed: 0, Passed: 394, Skipped: 0, Total: 394
```

---------

Co-authored-by: Claude Sonnet 4.6 <[email protected]>
Co-authored-by: westey <[email protected]>
 2026-07-22 10:09:54 +00:00
King StarandRoger Barreto e15ae168f6 .Net: Reject mixed-separator UNC paths in file plugins (#14166) 
### Motivation and Context

`FileIOPlugin` and `WebFileDownloadPlugin` rejected only some UNC path
prefixes before path canonicalization. On Windows, mixed `/\` and `\/`
prefixes resolve to UNC paths too, so those forms could reach filesystem
path resolution before the allow-list rejected them.

Fixes #14157.

### Description

- Treat any two leading `/` or `\` characters as a UNC or extended-path
prefix in both plugins.
- Reject those paths before canonicalization, `File.Exists`, or
`File.GetAttributes` can probe the filesystem.
- Add read, write, and download regressions for all four separator
combinations.

The change is limited to the two plugins named in the issue.
Single-separator rooted paths, normal local paths, allow-list behavior,
symlink handling, overwrite checks, and download limits are unchanged.

### Verification

```bash
dotnet test dotnet/src/Plugins/Plugins.UnitTests/Plugins.UnitTests.csproj --filter "FullyQualifiedName~ItRejectsUncOrExtendedPathsOnReadAsync|FullyQualifiedName~ItRejectsUncOrExtendedPathsOnWriteAsync|FullyQualifiedName~DownloadToFileRejectsUncOrExtendedPathsAsync"
dotnet test dotnet/src/Plugins/Plugins.UnitTests/Plugins.UnitTests.csproj --filter "FullyQualifiedName~FileIOPluginTests"
dotnet test dotnet/src/Plugins/Plugins.UnitTests/Plugins.UnitTests.csproj --filter "FullyQualifiedName!~DownloadToFileSucceedsAsync&FullyQualifiedName!~DownloadToFileFailsForInvalidParametersAsync"
dotnet format dotnet/src/Plugins/Plugins.UnitTests/Plugins.UnitTests.csproj --verify-no-changes --no-restore
```

The focused regressions pass 12/12, all `FileIOPluginTests` pass 21/21,
and the deterministic Plugins unit-test suite passes 409/409. The two
excluded Web tests use a live HTTPS request and fail on unmodified
`main` in this macOS environment because certificate revocation status
is unavailable.

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
(409 deterministic tests pass; two live-network baseline tests are
environment-limited as noted above)
- [x] I didn't break anyone 😄

---------

Signed-off-by: King Star <[email protected]>
Co-authored-by: Roger Barreto <[email protected]>
 2026-07-20 21:02:53 +00:00
Roger Barreto 33a3e555e9 .Net: [BREAKING] Upgrade Prompty.Core to 2.0.0-beta.3 to resolve NU1903 vulnerability (#14169) 
## Motivation and Context

CI (`dotnet-build-and-test`) currently fails repo-wide on **NU1903**:
`Prompty.Core` `0.2.3-beta` has a known high severity advisory
[GHSA-wxhm-2mq7-7697](https://github.com/advisories/GHSA-wxhm-2mq7-7697)
(path traversal in `${file:...}` reference expansion). The build treats
the audit as an error (`--warnaserror`), so this blocks every .NET PR.

The advisory is fixed in `Prompty.Core` **2.0.0-beta.2+**. That release
is a significant rewrite: it targets **net9.0 only** and ships a new
`.prompty` spec and API. There is no intermediate 0.x fix, so resolving
the advisory requires this upgrade.

## Description

Upgrades `Prompty.Core` `0.2.3-beta` → `2.0.0-beta.3` and adapts
Semantic Kernel to the 2.0 surface.

- **Package**: bump `Prompty.Core` in `Directory.Packages.props`; remove
the `Scriban` workaround reference (2.0 no longer depends on it).
- **Target frameworks**: retarget `Functions.Prompty` to `net10.0` only.
The fixed package is net9.0-only, so `net8.0` and `netstandard2.0` can
no longer be supported.
- **Loader migration** (`KernelFunctionPrompty`):
  - Text input: `FrontmatterParser.Parse` + `Prompty.Load`.
- File input: secure `PromptyLoader.Load` with `AllowedFileRoots` scoped
to the prompty file's directory, so `${file:...}` references are
confined (the fix for the advisory).
- Parse failures are normalized to `ArgumentException` to preserve the
input-validation contract.
- **Test data + tests**: migrate the `.prompty` files to the 2.0 spec
(`apiType`, list-form `inputs`, renamed `options`) and update
`PromptyTests` accordingly.
- **Samples**: update the `Concepts` inline templates to the 2.0 spec.

## ⚠️ Breaking changes

`Microsoft.SemanticKernel.Prompty` is a preview (`-beta`) package. This
change:

- **Drops `net8.0` and `netstandard2.0`** support (now `net10.0` only).
- Requires `.prompty` files to use the **2.0 spec** (`model.apiType`,
`model.provider`, `connection.kind`, `inputs`/`outputs` as lists,
renamed `model.options`). v1 files are not auto-migrated. See the
[Prompty v1→v2 migration guide](https://www.prompty.ai/migration/).
- No longer surfaces the following, which are not part of the 2.0 model:
input/output `json_schema`, connection `service_id`, and arbitrary
`model.options` passthrough beyond the strongly typed set.

## Validation

- `Functions.Prompty.UnitTests`: **22/22 pass** (Release,
`--warnaserror`).
- `Functions.Prompty` and `Concepts` build clean, **no NU1903**.
- `dotnet format --verify-no-changes` clean on changed projects.
- Behavior coherence: rendered prompt output for the `Concepts` samples
is **byte-for-byte identical** to the previously published package, and
the samples were run end-to-end against a live model with the expected
results.

## Contribution Checklist

- [x] The code builds clean without errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] All unit tests pass, and I have added/updated tests where possible
- [x] I didn't break anyone 😄
 2026-07-20 17:07:06 +00:00
Octopusocto-patchRoger Barreto
 		c781da134e .Net: fix: address three static analysis issues (audio format, text search, KernelProcess) (#13925) 
Fixes #13922

## Problem
Three static analysis issues identified by PVS-Studio in the .NET
codebase:

1. **`ClientCore.ChatCompletion.cs`** — `GetAudioOutputMimeType`
contained a duplicate `ChatOutputAudioFormat.Wav` check (lines 985 and
1000) making the second branch unreachable. The `Aac` audio format
supported by the OpenAI SDK was silently unhandled, causing a
`NotSupportedException` at runtime.

2. **`TextSearchStore.cs`** — `GetTextSearchResultsAsync` assigned a
LINQ expression to a `results` variable (deferred execution) that was
never iterated. The return statement duplicated the projection. The
unused variable was dead code.

3. **`KernelProcess.cs`** — The constructor accepted a `threads`
parameter but never assigned it to the `Threads` property, silently
discarding all threads passed by callers.

## Solution
1. Replace the second `Wav` branch with an `Aac` branch and update the
error message to list `'aac'` as a supported format.
2. Reuse the `results` variable in the `return` statement instead of
duplicating the `Select` projection.
3. Assign the `threads` parameter to `this.Threads` when it is not null.

## Testing
- Changes are logic-only with no new external dependencies.
- Existing unit tests for `OpenAIChatCompletionService` and
`TextSearchStore` continue to apply.
- No new runtime behaviour is introduced for the `Wav` fix (it was
already handled earlier in the method); `Aac` now maps to `"audio/aac"`
as expected.

---------

Co-authored-by: octo-patch <[email protected]>
Co-authored-by: Roger Barreto <[email protected]>
 2026-07-09 17:05:41 +00:00
AZJandRoger Barreto 008d40acb4 .Net: feat(ollama): add Think property to OllamaPromptExecutionSettings (#14122) 
## Summary

- Adds `Think` (`bool?`) property to `OllamaPromptExecutionSettings` to
control thinking for Ollama reasoning models (deepseek-r1, qwen3,
phi4-reasoning)
- Maps `Think` to `GenerateRequest.Think` in
`OllamaTextGenerationService.CreateRequest()`
- Bumps OllamaSharp from 5.4.12 to 5.4.25 which introduces
`GenerateRequest.Think`

## Motivation

Fixes #14078. When a reasoning model has thinking enabled by default
(e.g. qwen3, phi4-reasoning), the model output lands in a separate
thinking stream rather than the standard response field. This causes
`GetTextContentsAsync` to return empty content. The only way to get a
usable response is to pass `think=false` to suppress thinking, but there
was no way to set that from `OllamaPromptExecutionSettings`.

## Changes

### `OllamaPromptExecutionSettings.cs`
- New `Think` property with `bool?` type, JSON name `think`,
`WhenWritingNull` ignore condition, `ThrowIfFrozen()` guard, and
`Clone()` support

### `OllamaTextGenerationService.cs`
- `CreateRequest()` maps `settings.Think` to `GenerateRequest.Think`
using `OllamaSharp.Models.Chat.ThinkValue`

### `Directory.Packages.props`
- OllamaSharp bumped from 5.4.12 to 5.4.25 (adds `GenerateRequest.Think`
and `ThinkValue`)

### Tests
- `OllamaPromptExecutionSettingsTests`: serialization round-trip, Clone,
Freeze guard for `Think`
- `OllamaTextGenerationTests`: verifies `Think` is present/absent in the
serialized request payload for both `GetTextContentsAsync` and
`GetStreamingTextContentsAsync`

## Test plan

- [ ] All 115 existing unit tests pass (1 pre-existing skip)
- [ ] `ThinkPropertyRoundTripsViaSerialization` - `true`/`false`
round-trips via JSON
- [ ] `ThinkPropertyIsPreservedByClone` - Clone copies the value
- [ ] `ThinkPropertyThrowsWhenFrozen` - setter throws after Freeze
- [ ] `GetTextContentsShouldSendThinkSettingAsync` - request payload
contains correct `think` field
- [ ] `GetTextContentsShouldNotSendThinkWhenNotSetAsync` - request
payload omits `think` when null
- [ ] `GetStreamingTextContentsShouldSendThinkSettingAsync` - streaming
path also sends `think`

---------

Co-authored-by: Roger Barreto <[email protected]>
 2026-07-09 13:41:58 +00:00
SergeyMenshykhandCopilot 35ba23e1b3 .Net: Update package version to 1.78.0 (#14142) 
Bumps the SK package version in preparation for the next release.

- VersionPrefix: 1.77.0 -> 1.78.0
- PackageValidationBaselineVersion: 1.76.0 -> 1.77.0

---------

Co-authored-by: Copilot <[email protected]>
 2026-07-07 10:58:06 +00:00
Roger Barreto f6391ad8b6 Python: OpenApi: Harden operation path handling for consistent selection and request targeting (.Net & Python) (#14140) 
## Motivation and Context

The OpenAPI plugin imports operations from a spec and lets the host
restrict which operations are exposed via an
`OperationSelectionPredicate` (and via `OperationsToExclude`). Operation
selection and request-URL construction should share one canonical
interpretation of an operation path. This change closes two consistency
gaps where a spec-supplied path could be interpreted differently at
selection time than at request time.

1. **Selection vs. request path normalization.** The selection predicate
received the raw operation path, while the request URL is built from a
canonicalized path. An encoded dot-segment (for example `%2e%2e`) is
textually different from the endpoint it canonicalizes to, so it could
pass a path-based include/exclude filter yet resolve to a different
route. Operations whose path contains an encoded or literal dot-segment
are now excluded before the predicate is consulted, symmetric with the
existing request-time dot-segment rejection.

2. **Request target reconciliation (defense in depth).** After the
request URL is built, verify it did not move off the configured server.
An operation path that is an absolute or authority-changing URI (for
example `https://another-host/admin`) carries no dot-segment, so it
passes path-segment validation, yet `System.Uri` / `urljoin` resolve it
to a different scheme, host, or port. Such a request is now rejected
before it is sent, so a credential-bearing request cannot be redirected
to an unintended target.

Both changes are applied symmetrically to the .NET and Python OpenAPI
ports.

## Description

- **.NET**
- `OpenApiDocumentParser` skips operations whose path contains a
dot-segment before invoking the selection predicate.
- `RestApiOperation` extracts a shared `ContainsDotSegment` helper
(reused by the existing `ValidatePathSegments`) and, after building the
request URL, reconciles its scheme/host/port and base path against the
configured server.
- **Python**
- `openapi_parser` skips dot-segment operations before the predicate
runs.
- `rest_api_operation` adds a shared `_contains_dot_segment` helper and
a post-construction `_ensure_request_target_matches_server`
reconciliation.

## Tests

- .NET: added selection-exclusion and request-target reconciliation
tests; full `Functions.UnitTests` OpenApi suite green (488).
- Python: added parity tests for both behaviors;
`tests/unit/connectors/openapi_plugin` green (173), ruff + ruff-format +
mypy + pre-commit clean.

## Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines
- [x] All unit tests pass, and I have added new tests where possible
 2026-07-06 16:43:25 +00:00
SergeyMenshykhandCopilot e6c9673684 .Net: Disable automatic HTTP redirects in HttpPlugin and WebFileDownloadPlugin default clients (#14132) 
The default HTTP clients used by `HttpPlugin` and
`WebFileDownloadPlugin` now have `AllowAutoRedirect` set to `false`.
This ensures the `AllowedDomains` restriction is enforced consistently
regardless of server responses.

- Added `GetNonRedirectingHttpClient()` to `HttpClientProvider` (all
target frameworks)
- Updated both plugins to use non-redirecting clients by default
- Added unit tests verifying redirect responses are not followed
- Updated XML documentation

Co-authored-by: Copilot <[email protected]>
 2026-07-02 16:59:44 +00:00
SergeyMenshykhandCopilot f25753be0a Bump Scriban from 7.2.0 to 7.2.5 to fix NU1902 vulnerability (#14133) 
Fixes CI failure caused by NU1902 errors due to known moderate severity
vulnerabilities in Scriban 7.2.0 (GHSA-6q7j-xr26-3h2c,
GHSA-q6rr-fm2g-g5x8).

Co-authored-by: Copilot <[email protected]>
 2026-07-01 18:44:43 +00:00
SergeyMenshykhandCopilot dfc5227227 .Net: Update .NET SDK to 10.0.301 (#14119) 
Updates the .NET SDK version in `dotnet/global.json` from `10.0.100` to
`10.0.301`.

Co-authored-by: Copilot <[email protected]>
 2026-06-25 13:37:21 +00:00
dependabot[bot]copilot-swe-agent[bot]SergeyMenshykh
 		cf9af8b966 .Net: Bump axios to 1.16.0 and form-data to 4.0.6 in /dotnet/samples/Demos/ProcessFrameworkWithSignalR (#13858) 
### Motivation and Context

This update is required to resolve the current Dependabot security
alerts for the sample npm manifest in
`dotnet/samples/Demos/ProcessFrameworkWithSignalR`.

### Description

Updates the sample manifest to require `axios` `^1.16.0` and regenerates
the lockfile so the resolved dependency set includes:

- `axios` `1.16.0`
- `form-data` `4.0.6`
- compatible transitive updates such as `follow-redirects` `1.16.0`

These changes keep the scope limited to the sample's `package.json` and
`package-lock.json` while clearing the reported npm audit findings for
this manifest.

### Contribution Checklist

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄

> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: SergeyMenshykh <[email protected]>
 2026-06-25 13:21:45 +00:00
SergeyMenshykhandCopilot e99c633fba .Net: Harden file path validation in Core, Document, and Web plugins (#14118) 
## Motivation and Context

This change hardens file system path handling in the file-based plugins.
Previously, the path used for allowlist validation could differ from the
path ultimately used for file I/O, so the two operations were not
guaranteed to refer to the same file system location.

## Description

- Adds a shared `PathUtilities.GetSafeFullPath` helper that produces a
canonical full path for a given input.
- Updates `FileIOPlugin`, `SessionsPythonPlugin`, `DocumentPlugin` and
`WebFileDownloadPlugin` to validate and perform I/O against the same
canonical path, and to compare paths using OS-appropriate string
comparison.
- Adds regression tests covering the new behavior.

## Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines
- [x] All unit tests pass, and I have added new tests where possible

---------

Co-authored-by: Copilot <[email protected]>
 2026-06-25 09:39:45 +00:00
dependabot[bot]andSergeyMenshykh 99d1953e93 Bump axios from 1.13.2 to 1.16.0 in /dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend (#14044) 
Bumps [axios](https://github.com/axios/axios) from 1.13.2 to 1.16.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/releases">axios's
releases</a>.</em></p>
<blockquote>
<h2>v1.16.0 — May 2, 2026</h2>
<p>This release adds support for the QUERY HTTP method and a new
<code>ECONNREFUSED</code> error constant, lands a substantial wave of
HTTP, fetch, and XHR adapter bug fixes around redirects, aborts,
headers, and timeouts, and welcomes 23 new contributors.</p>
<h2>⚠️ Notable Changes</h2>
<p>A handful of fixes in this release are either security-adjacent or
change observable behaviour. Please review before upgrading:</p>
<ul>
<li><strong>Fetch adapter now enforces <code>maxBodyLength</code> and
<code>maxContentLength</code>.</strong> These limits were silently
ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as
a safety net (DoS protection, accidental large uploads) had no
protection. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>)</li>
<li><strong>Proxy requests now preserve user-supplied <code>Host</code>
headers.</strong> Previously, the proxy path could overwrite a custom
<code>Host</code>. Virtual-host-style routing through a proxy will now
behave correctly. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>)</li>
<li><strong>Basic auth credentials embedded in URLs are now
URL-decoded.</strong> If you have percent-encoded credentials in a URL
(e.g. <code>https://user:p%40ss@host</code>), the decoded value is what
now goes on the wire. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li>
<li><strong><code>parseProtocol</code> now strictly requires a colon in
the protocol separator.</strong> Strings that loosely parsed as
protocols before may no longer match. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li>
<li><strong>Deprecated <code>unescape()</code> replaced with modern
UTF-8 encoding.</strong> Non-ASCII URL handling is now spec-correct;
consumers depending on legacy <code>unescape()</code> quirks may see
different output bytes. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li>
<li><strong><code>transformRequest</code> input typing change was
reverted.</strong> The typing change introduced in <a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a>
was reverted in <a
href="https://redirect.github.com/axios/axios/issues/10810">#10810</a>
after follow-up review — net behavior is unchanged from 1.15.2.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong>QUERY HTTP Method:</strong> Added support for the QUERY HTTP
method across adapters and type definitions. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10802">#10802</a></strong>)</li>
<li><strong>ECONNREFUSED Error Constant:</strong> Exposed
<code>ECONNREFUSED</code> as a constant on <code>AxiosError</code> so
callers can match connection-refused failures without comparing string
literals (closes <a
href="https://redirect.github.com/axios/axios/issues/6485">#6485</a>).
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li>
<li><strong>Encode Helper Export:</strong> Exported the internal
<code>encode</code> helper from <code>buildURL</code> so userland param
serializers can reuse the same encoding logic that axios uses
internally. (<strong><a
href="https://redirect.github.com/axios/axios/issues/6897">#6897</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>HTTP Adapter — Redirects &amp; Headers:</strong> Cleared
stale headers when a redirect targets a no-proxy host, fixed the
redirect listener chain so listeners no longer stack across hops,
restored the missing <code>requestDetails</code> argument on
<code>beforeRedirect</code>, preserved user-supplied <code>Host</code>
headers when forwarding through a proxy, and properly URL-decoded basic
auth credentials. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10794">#10794</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10800">#10800</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/6241">#6241</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li>
<li><strong>HTTP Adapter — Streams &amp; Timeouts:</strong> Preserved
the partial response object on <code>AxiosError</code> when a stream is
aborted after headers arrive, honoured the <code>timeout</code> option
during the connect phase when redirects are disabled, and resolved an
unsettled-promise hang when an aborted request was combined with
compression and <code>maxRedirects: 0</code>. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10708">#10708</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10819">#10819</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7149">#7149</a></strong>)</li>
<li><strong>Fetch Adapter:</strong> Enforced <code>maxBodyLength</code>
/ <code>maxContentLength</code> in the fetch adapter, set the
<code>User-Agent</code> header to match the HTTP adapter, preserved the
original abort reason instead of replacing it with a generic error, and
deferred global access so importing the module no longer throws a
<code>TypeError</code> in restricted environments. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10772">#10772</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10806">#10806</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7260">#7260</a></strong>)</li>
<li><strong>XHR Adapter:</strong> Unsubscribed the
<code>cancelToken</code> and <code>AbortSignal</code> listeners on the
error, timeout, and abort code paths to prevent leaked subscriptions.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li>
<li><strong>Error Handling:</strong> Attached the parsed response to
<code>AxiosError</code> when <code>JSON.parse</code> fails inside
<code>dispatchRequest</code>, prevented <code>settle</code> from
emitting <code>undefined</code> error codes, and tightened the
<code>parseProtocol</code> regex to require a colon in the protocol
separator. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10724">#10724</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7276">#7276</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li>
<li><strong>Types &amp; Exports:</strong> Aligned the CommonJS
<code>CancelToken</code> typings with the ESM build, fixed a compiler
error caused by <code>RawAxiosHeaders</code>, and re-exported
<code>create</code> from the package index. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7414">#7414</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/6389">#6389</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/6460">#6460</a></strong>)</li>
<li><strong>UTF-8 Encoding:</strong> Replaced the deprecated
<code>unescape()</code> call with a modern UTF-8 encoding
implementation. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li>
<li><strong>Misc Cleanup:</strong> Resolved a batch of small
inconsistencies and gadget-level issues across the codebase. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10833">#10833</a></strong>)</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li><strong>Refactor — ES6 Modernisation:</strong> Modernised the
<code>utils</code> module and XHR adapter to use ES6 features, and
tidied the multipart boundary error message. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li>
<li><strong>Tests:</strong> Hardened the HTTP test server lifecycle to
fix flaky <code>FormData</code> EPIPE failures, fixed Win32 platform
support for the pipe tests, and corrected an incorrect test assumption.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10820">#10820</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10791">#10791</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10796">#10796</a></strong>)</li>
<li><strong>Docs:</strong> Documented
<code>paramsSerializer.encode</code> for strict RFC 3986 query encoding,
updated the <code>parseReviver</code> TypeScript definitions and
configuration docs for ES2023, added timeout guidance to the README's
first async example, and expanded notes around the recent type changes.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10821">#10821</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10782">#10782</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10759">#10759</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10804">#10804</a></strong>)</li>
<li><strong>Reverted:</strong> Reverted the
<code>transformRequest</code> input typing change from <a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a>
after follow-up review. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li>
<li><strong>Dependencies:</strong> Bumped
<code>actions/setup-node</code>, the <code>github-actions</code> group,
and <code>postcss</code> (in <code>/docs</code>) to their latest
versions. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10785">#10785</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10813">#10813</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10814">#10814</a></strong>)</li>
<li><strong>Release:</strong> Updated changelog and packages, and
prepared the 1.16.0 release. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10790">#10790</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10834">#10834</a></strong>)</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve axios:</p>
<ul>
<li><strong><a
href="https://github.com/singhankit001"><code>@​singhankit001</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>)</li>
<li><strong><a
href="https://github.com/cuiweixie"><code>@​cuiweixie</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li>
<li><strong><a
href="https://github.com/iruizsalinas"><code>@​iruizsalinas</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li>
<li><strong><a
href="https://github.com/MarcosNocetti"><code>@​MarcosNocetti</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li>
<li><strong><a
href="https://github.com/deepview-autofix"><code>@​deepview-autofix</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's
changelog</a>.</em></p>
<blockquote>
<h2>v1.16.0 — May 2, 2026</h2>
<p>This release adds support for the QUERY HTTP method and a new
<code>ECONNREFUSED</code> error constant, lands a substantial wave of
HTTP, fetch, and XHR adapter bug fixes around redirects, aborts,
headers, and timeouts, and welcomes 23 new contributors.</p>
<h2>⚠️ Notable Changes</h2>
<p>A handful of fixes in this release are either security-adjacent or
change observable behaviour. Please review before upgrading:</p>
<ul>
<li><strong>Fetch adapter now enforces <code>maxBodyLength</code> and
<code>maxContentLength</code>.</strong> These limits were silently
ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as
a safety net (DoS protection, accidental large uploads) had no
protection. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>)</li>
<li><strong>Proxy requests now preserve user-supplied <code>Host</code>
headers.</strong> Previously, the proxy path could overwrite a custom
<code>Host</code>. Virtual-host-style routing through a proxy will now
behave correctly. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>)</li>
<li><strong>Basic auth credentials embedded in URLs are now
URL-decoded.</strong> If you have percent-encoded credentials in a URL
(e.g. <code>https://user:p%40ss@host</code>), the decoded value is what
now goes on the wire. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li>
<li><strong><code>parseProtocol</code> now strictly requires a colon in
the protocol separator.</strong> Strings that loosely parsed as
protocols before may no longer match. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li>
<li><strong>Deprecated <code>unescape()</code> replaced with modern
UTF-8 encoding.</strong> Non-ASCII URL handling is now spec-correct;
consumers depending on legacy <code>unescape()</code> quirks may see
different output bytes. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li>
<li><strong><code>transformRequest</code> input typing change was
reverted.</strong> The typing change introduced in <a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a>
was reverted in <a
href="https://redirect.github.com/axios/axios/issues/10810">#10810</a>
after follow-up review — net behavior is unchanged from 1.15.2.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong>QUERY HTTP Method:</strong> Added support for the QUERY HTTP
method across adapters and type definitions. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10802">#10802</a></strong>)</li>
<li><strong>ECONNREFUSED Error Constant:</strong> Exposed
<code>ECONNREFUSED</code> as a constant on <code>AxiosError</code> so
callers can match connection-refused failures without comparing string
literals (closes <a
href="https://redirect.github.com/axios/axios/issues/6485">#6485</a>).
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li>
<li><strong>Encode Helper Export:</strong> Exported the internal
<code>encode</code> helper from <code>buildURL</code> so userland param
serializers can reuse the same encoding logic that axios uses
internally. (<strong><a
href="https://redirect.github.com/axios/axios/issues/6897">#6897</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>HTTP Adapter — Redirects &amp; Headers:</strong> Cleared
stale headers when a redirect targets a no-proxy host, fixed the
redirect listener chain so listeners no longer stack across hops,
restored the missing <code>requestDetails</code> argument on
<code>beforeRedirect</code>, preserved user-supplied <code>Host</code>
headers when forwarding through a proxy, and properly URL-decoded basic
auth credentials. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10794">#10794</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10800">#10800</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/6241">#6241</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li>
<li><strong>HTTP Adapter — Streams &amp; Timeouts:</strong> Preserved
the partial response object on <code>AxiosError</code> when a stream is
aborted after headers arrive, honoured the <code>timeout</code> option
during the connect phase when redirects are disabled, and resolved an
unsettled-promise hang when an aborted request was combined with
compression and <code>maxRedirects: 0</code>. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10708">#10708</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10819">#10819</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7149">#7149</a></strong>)</li>
<li><strong>Fetch Adapter:</strong> Enforced <code>maxBodyLength</code>
/ <code>maxContentLength</code> in the fetch adapter, set the
<code>User-Agent</code> header to match the HTTP adapter, preserved the
original abort reason instead of replacing it with a generic error, and
deferred global access so importing the module no longer throws a
<code>TypeError</code> in restricted environments. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10772">#10772</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10806">#10806</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7260">#7260</a></strong>)</li>
<li><strong>XHR Adapter:</strong> Unsubscribed the
<code>cancelToken</code> and <code>AbortSignal</code> listeners on the
error, timeout, and abort code paths to prevent leaked subscriptions.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li>
<li><strong>Error Handling:</strong> Attached the parsed response to
<code>AxiosError</code> when <code>JSON.parse</code> fails inside
<code>dispatchRequest</code>, prevented <code>settle</code> from
emitting <code>undefined</code> error codes, and tightened the
<code>parseProtocol</code> regex to require a colon in the protocol
separator. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10724">#10724</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7276">#7276</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li>
<li><strong>Types &amp; Exports:</strong> Aligned the CommonJS
<code>CancelToken</code> typings with the ESM build, fixed a compiler
error caused by <code>RawAxiosHeaders</code>, and re-exported
<code>create</code> from the package index. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7414">#7414</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/6389">#6389</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/6460">#6460</a></strong>)</li>
<li><strong>UTF-8 Encoding:</strong> Replaced the deprecated
<code>unescape()</code> call with a modern UTF-8 encoding
implementation. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li>
<li><strong>Misc Cleanup:</strong> Resolved a batch of small
inconsistencies and gadget-level issues across the codebase. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10833">#10833</a></strong>)</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li><strong>Refactor — ES6 Modernisation:</strong> Modernised the
<code>utils</code> module and XHR adapter to use ES6 features, and
tidied the multipart boundary error message. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li>
<li><strong>Tests:</strong> Hardened the HTTP test server lifecycle to
fix flaky <code>FormData</code> EPIPE failures, fixed Win32 platform
support for the pipe tests, and corrected an incorrect test assumption.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10820">#10820</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10791">#10791</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10796">#10796</a></strong>)</li>
<li><strong>Docs:</strong> Documented
<code>paramsSerializer.encode</code> for strict RFC 3986 query encoding,
updated the <code>parseReviver</code> TypeScript definitions and
configuration docs for ES2023, added timeout guidance to the README's
first async example, and expanded notes around the recent type changes.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10821">#10821</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10782">#10782</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10759">#10759</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10804">#10804</a></strong>)</li>
<li><strong>Reverted:</strong> Reverted the
<code>transformRequest</code> input typing change from <a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a>
after follow-up review. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li>
<li><strong>Dependencies:</strong> Bumped
<code>actions/setup-node</code>, the <code>github-actions</code> group,
and <code>postcss</code> (in <code>/docs</code>) to their latest
versions. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10785">#10785</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10813">#10813</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10814">#10814</a></strong>)</li>
<li><strong>Release:</strong> Updated changelog and packages, and
prepared the 1.16.0 release. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10790">#10790</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10834">#10834</a></strong>)</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve axios:</p>
<ul>
<li><strong><a
href="https://github.com/singhankit001"><code>@​singhankit001</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>)</li>
<li><strong><a
href="https://github.com/cuiweixie"><code>@​cuiweixie</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li>
<li><strong><a
href="https://github.com/iruizsalinas"><code>@​iruizsalinas</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li>
<li><strong><a
href="https://github.com/MarcosNocetti"><code>@​MarcosNocetti</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li>
<li><strong><a
href="https://github.com/deepview-autofix"><code>@​deepview-autofix</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc"><code>df53d7d</code></a>
chore(release): prepare release 1.16.0 (<a
href="https://redirect.github.com/axios/axios/issues/10834">#10834</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/9d92bcd32639d1eea5b89f03ae45f248d3bb058e"><code>9d92bcd</code></a>
fix: gadgets and smaller issues (<a
href="https://redirect.github.com/axios/axios/issues/10833">#10833</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/5107ee69aee527b19eabaf80000ca65752135435"><code>5107ee6</code></a>
fix: prevent undefined error codes in settle (<a
href="https://redirect.github.com/axios/axios/issues/7276">#7276</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/e57349992f230b6b13e80613eb84302560aa5ba8"><code>e573499</code></a>
fix(fetch): defer global access in fetch adapter (<a
href="https://redirect.github.com/axios/axios/issues/7260">#7260</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/ad68e1a484b50086af427f767bbd7d6e3aab7ac3"><code>ad68e1a</code></a>
fix(http): honor timeout during connect without redirects (<a
href="https://redirect.github.com/axios/axios/issues/10819">#10819</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/2a51828213128691d2e37502b5eb2cf4965a737d"><code>2a51828</code></a>
fix(http): decode URL basic auth credentials (<a
href="https://redirect.github.com/axios/axios/issues/10825">#10825</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/0e8b6bbb542131bae9940618d84d5286255d4db1"><code>0e8b6bb</code></a>
fix(http): preserve user-supplied Host header when forwarding through a
proxy...</li>
<li><a
href="https://github.com/axios/axios/commit/79f39e1d041dca87173226d0255f90eaf252564b"><code>79f39e1</code></a>
docs: document paramsSerializer.encode for strict RFC 3986 query
encoding (<a
href="https://redirect.github.com/axios/axios/issues/1">#1</a>...</li>
<li><a
href="https://github.com/axios/axios/commit/0fe3a5fc14829535e1d517c662d448e86c33438e"><code>0fe3a5f</code></a>
[Docs/Types] Update <code>parseReviver</code> TypeScript definitions for
ES2023 and add ...</li>
<li><a
href="https://github.com/axios/axios/commit/cd6737fd84bdb7caf2a319d3579573a49f9d238d"><code>cd6737f</code></a>
chore: matches the sibling responseStream.on(aborted) handler and added
tests...</li>
<li>Additional commits viewable in <a
href="https://github.com/axios/axios/compare/v1.13.2...v1.16.0">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for axios since your current version.</p>
</details>
<details>
<summary>Install script changes</summary>
<p>This version modifies <code>prepare</code> script that runs during
installation. Review the package contents before updating.</p>
</details>
<br />

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: SergeyMenshykh <[email protected]>
 2026-06-25 09:36:05 +00:00
westey 82f244233b .Net: Update SK to use MEVD packages and move MEVD projects out of main solution (#14117) 
### Motivation and Context

- The MEVD packages are not shipped from this repo anymore.

### Description

- Moving the packages out of the main SK solution
- Update all projects to use MEVD.Abstractions package directly
- Revert some previous code changes to make the MEVD implementations
compatible with the last MEVD.Abstractions package released from this
repo.

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
 2026-06-24 16:51:21 +00:00