### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
Improved the URL validation logic in
`RestApiOperationRunner.ValidateUrl()` to ensure stricter matching when
checking request URLs against configured `AllowedBaseUrls`. The previous
implementation could match unintended URLs in certain edge cases
involving path-prefixed base URLs.
### Description
Strengthened the base URL comparison to enforce proper path-boundary
matching, preventing URLs outside the intended allowed scope from
passing validation.
### Changes
- **`RestApiOperationRunner.cs`**: Tightened the base URL matching logic
in `ValidateUrl` to enforce path-boundary alignment.
- **`RestApiOperationRunnerTests.cs`**: Added two new tests to verify
the stricter validation behavior and confirm legitimate sub-paths remain
allowed.
### Risk
Low — the fix tightens existing validation without changing the public
API surface. All URL validation tests pass.
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
In the SQL Server MEVD provider, table/schema/column names embedded
inside SQL string literals (`N'...'`) were not escaping single quotes.
This could produce broken SQL when names contain single quotes.
For example, a table named `it's` would generate:
```sql
IF OBJECT_ID(N'[dbo].[it's]', N'U') IS NULL
```
which is invalid SQL. The fix produces:
```sql
IF OBJECT_ID(N'[dbo].[it''s]', N'U') IS NULL
```
### Changes
Added `AppendTableNameInsideLiteral` and `AppendIdentifierInsideLiteral`
helper methods that escape single quotes by doubling them, and updated
the 5 call sites where identifiers appear inside string literals:
- `OBJECT_ID` in `CreateTable` (ifNotExists check)
- `OBJECT_ID` in full-text index PK lookup
- Dynamic SQL table name, column names, and catalog name for full-text
indexes
### Tests
Added unit tests for `AppendTableNameInsideLiteral`,
`AppendIdentifierInsideLiteral`, and a
`CreateTable_WithSingleQuoteInName` integration test. All 283 tests pass
(unit + conformance).
Co-authored-by: Copilot <[email protected]>
Updates the SQL Server vector store connector to support the latest
Azure SQL VECTOR_SEARCH() features, matching what was done in EF Core
(dotnet/efcore#38075).
## Changes
### VECTOR_SEARCH syntax update
- Replace deprecated `TOP_N` parameter with `SELECT TOP(N) WITH
APPROXIMATE`
- Enable iterative WHERE predicates are now applied during the vector
search process, not after retrievalfiltering
- Support `skip` via subquery wrapping (`TOP` and `OFFSET/FETCH` cannot
coexist in the same SELECT)
### Hybrid search
- Same VECTOR_SEARCH syntax changes in the semantic search CTE
- Filter support added in the vector search CTE (iterative filtering)
### Azure SQL runtime detection
- DiskAnn vector indexes and VECTOR_SEARCH require Azure SQL Database or
SQL database in Microsoft Fabric
- Added runtime check via `SERVERPROPERTY('EngineEdition')` at table
creation and query time
- Throws informative `NotSupportedException` when used against on-prem
SQL Server
- Result is cached per collection instance
### Test infrastructure
- Deleted `SqlServerDiskAnnVectorSearchTests.cs` (read-only table
workaround no longer tables with latest vector indexes now support full
DML)needed
- Created `SqlServerConnectionStringRequiredAttribute` to gate DiskAnn
tests on Azure SQL connection string availability
- Rewrote DiskAnn conformance test to handle 100-row minimum requirement
for vector index creation
- Updated all command builder unit tests for new SQL syntax
### Kept
- `PREVIEW_FEATURES` command in `CreateTable` (needed for future on-prem
SQL Server support)
---------
Co-authored-by: Copilot <[email protected]>
We are currently using Npgsql 8.0 because that's the last version that's
still compatible with .NET Standard 2.0/netfx; but it seems wrong to
force an older version of Npgsql on modern .NET users just because netfx
users require it
So for the versions of the PgVector MEVD provider targeting
net8.0/net10.0, use the latest Npgsql 10.0; netstandard2.0/net462 still
use Npgsql 8.0. It's not ideal to use different versions of Npgsql
across different TFM targets of the same library, but it seems like the
lesser of the possible evils here.
This incidentally also takes care of the ReloadTypesAsync problem in
#13706.
---------
Co-authored-by: Copilot <[email protected]>
## Changes
* **Extract `ConfigureVectorPropertyEmbedding()`**: Deduplicated
embedding resolution logic that was repeated across
`ProcessTypeProperties` and `ProcessRecordDefinition`.
* **Replace `IRecordCreator` with `Func<object>`**: Removed
`IRecordCreator` interface and two implementing classes
(`ActivatorBasedRecordCreator`, `DynamicRecordCreator`), replacing them
with simple lambdas.
* **Rename `TemporaryStorageName` → `SerializedKeyName`**: Moved from
`PropertyModel` base to `KeyPropertyModel` where it belongs (only used
by CosmosNoSql for key property JSON serializer name remapping).
* **Delegate-based property accessors**: Replaced virtual
`GetValueAsObject`/`SetValueAsObject` overrides with delegate fields
(`_getter`/`_setter`), configured via
`ConfigurePocoAccessors()`/`ConfigureDynamicAccessors()`. Converted
null-coalescing throws to `Debug.Assert`.
* **Improved xmldoc** on `VectorPropertyModel.EmbeddingType` explaining
the `[AllowNull]` invariant.
* **Introduce read-only interfaces** (`IPropertyModel`,
`IKeyPropertyModel`, `IDataPropertyModel`, `IVectorPropertyModel`):
`CollectionModel` now exposes `IReadOnlyList<IVectorPropertyModel>`
etc., giving providers an immutable view post-build. All provider code
updated to consume interface types.
Note that the last is a non-trivial breaking change for providers (not
users), which I think is fine (note that the provider-facing APIs are
flagged as [Experimental]).
---------
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
`VectorStoreKeyAttribute.IsAutoGenerated` was typed as `bool?`, which C#
does not permit as a compile-time attribute argument. This made the
following valid-looking code fail to compile:
```csharp
[VectorStoreKey(StorageName = "name", IsAutoGenerated = true)]
public Guid Key { get; set; }
```
### Description
- **`VectorStoreKeyAttribute.IsAutoGenerated`**: Changed from `public
bool?` to a `public bool` property. Its setter stores the value into a
new `internal bool? IsAutoGeneratedNullable` backing property. The
getter returns `IsAutoGeneratedNullable.GetValueOrDefault()` rather than
throwing; an inline comment explains this is a workaround for the C#
compiler restriction that prevents `Nullable<bool>` from being used as a
compile-time attribute argument. The `bool?` backing preserves the "not
explicitly set" vs. "explicitly set" distinction the framework relies
on.
- **`CollectionModelBuilder`**: Updated to read
`keyAttribute.IsAutoGeneratedNullable` (the `bool?` backing) instead of
the former `bool?` public property, keeping the existing `??
SupportsKeyAutoGeneration(...)` fallback behaviour intact.
- **`KernelFunctionFromMethod`**: Fixed a pre-existing operator
precedence bug in a pattern match expression (`value is not JsonElement
or JsonDocument or JsonNode`) that caused CS9336 redundant-pattern
errors on the .NET 10 compiler. Added parentheses to correctly express
the intended negation of all three types: `value is not (JsonElement or
JsonDocument or JsonNode)`.
- **`CollectionModelBuilderTests`**: Added four new unit tests covering
all `IsAutoGenerated` attribute scenarios: explicitly set to `true`,
explicitly set to `false`, omitted on a `Guid` key (fallback to
`SupportsKeyAutoGeneration` returns `true`), and omitted on an `int` key
(fallback returns `false`).
```csharp
// Now compiles and works correctly
[VectorStoreKey(IsAutoGenerated = true)]
public Guid Key { get; set; }
[VectorStoreKey(IsAutoGenerated = false)]
public Guid Key { get; set; }
[VectorStoreKey] // IsAutoGeneratedNullable remains null, fallback to SupportsKeyAutoGeneration()
public Guid Key { get; set; }
```
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
<!-- START COPILOT ORIGINAL PROMPT -->
<details>
<summary>Original prompt</summary>
>
> ----
>
> *This section details on the original issue you should resolve*
>
> <issue_title>[MEVD] Can't set IsAutoGenerated property of
VectorStoreKeyAttribute at compile time</issue_title>
> <issue_description>The following code fails to compile:
>
> ```csharp
> [VectorStoreKey(StorageName = "name", IsAutoGenerated = true)]
> public Guid Key { get; set; }
> ```
>
> Because the `IsAutoGenerated` is `bool?`:
>
>
https://github.com/microsoft/semantic-kernel/blob/082e28e52ec2b45ad8cf287176d844150617e8b5/dotnet/src/VectorData/VectorData.Abstractions/RecordAttributes/VectorStoreKeyAttribute.cs#L30
>
> Which in C# maps to `System.Nullable<bool>` (a struct) and can't be
set at compile time.
>
> Could we make it just a `bool` like what it's mapped to at the end?
>
>
https://github.com/microsoft/semantic-kernel/blob/082e28e52ec2b45ad8cf287176d844150617e8b5/dotnet/src/VectorData/VectorData.Abstractions/ProviderServices/KeyPropertyModel.cs#L18
>
> Context:
https://github.com/dotnet/extensions/pull/7423/changes#r2974567816
>
> cc @roji </issue_description>
>
> <agent_instructions>1. Make
[this](https://github.com/microsoft/semantic-kernel/blob/082e28e52ec2b45ad8cf287176d844150617e8b5/dotnet/src/VectorData/VectorData.Abstractions/RecordAttributes/VectorStoreKeyAttribute.cs#L30)
property be a `bool` rather than `bool?` property.
> 2. Implement the getter and setter for it.
> 3. The setter should set an internal `bool?` property that should be
used instead of the public property everywhere in the repo.
[Example]https://github.com/microsoft/semantic-kernel/blob/082e28e52ec2b45ad8cf287176d844150617e8b5/dotnet/src/VectorData/VectorData.Abstractions/ProviderServices/CollectionModelBuilder.cs#L162)
> 3. Proof of concept code that I've used to verify it's going to get us
what we need:
>
> ```csharp
> using System.Reflection;
>
> namespace ConsoleApp15
> {
> public class Program
> {
> static void Main()
> {
> TestAttribute setToTrue =
typeof(Program).GetMethod(nameof(SetToTrue))!.GetCustomAttribute<TestAttribute>()!;
> Console.WriteLine($"IsAutoGenerated_Core for [Test(IsAutoGenerated =
true)]: {setToTrue.IsAutoGenerated_Core}");
>
> TestAttribute setToFalse =
typeof(Program).GetMethod(nameof(SetToFalse))!.GetCustomAttribute<TestAttribute>()!;
> Console.WriteLine($"IsAutoGenerated_Core for [Test(IsAutoGenerated =
false)]: {setToFalse.IsAutoGenerated_Core}");
>
> TestAttribute notSet =
typeof(Program).GetMethod(nameof(NotSet))!.GetCustomAttribute<TestAttribute>()!;
> Console.WriteLine($"IsAutoGenerated_Core for [Test]:
{notSet.IsAutoGenerated_Core}");
> }
>
> [Test(IsAutoGenerated = true)]
> public static void SetToTrue() { }
>
> [Test(IsAutoGenerated = false)]
> public static void SetToFalse() { }
>
> [Test]
> public static void NotSet() { }
> }
>
> [AttributeUsage(AttributeTargets.All)]
> public class TestAttribute : Attribute
> {
> public bool IsAutoGenerated
> {
> get => throw new InvalidOperationException(); // provided to satisfy
compiler requirements
> set => IsAutoGenerated_Core = value;
> }
>
> internal bool? IsAutoGenerated_Core { get; set; }
> }
> }
> ```</agent_instructions>
>
> ## Comments on the Issue (you are @copilot in this section)
>
> <comments>
> </comments>
>
</details>
<!-- START COPILOT CODING AGENT SUFFIX -->
- Fixesmicrosoft/semantic-kernel#13697
<!-- START COPILOT CODING AGENT TIPS -->
---
💬 Send tasks to Copilot coding agent from
[Slack](https://gh.io/cca-slack-docs) and
[Teams](https://gh.io/cca-teams-docs) to turn conversations into code.
Copilot posts an update in your thread when it's finished.
---------
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: adamsitnik <[email protected]>
Removes all legacy filtering logic from MEVD, leaving only (obsoleted)
FilterClause and subclasses, which are still needed by ITextSearch (see
conversation in
https://github.com/microsoft/semantic-kernel/pull/13384#discussion_r2867207653).
As suggested by @westey-m let's do an SK release before merging this
(see above).
Closes#10456
/cc @alzarei
### Motivation and Context
**Why is this change required?**
PR #10489 added support for configuring embedding [dimensions]
(outputDimensionality) for the Google AI connector, but the equivalent
Vertex AI connector was not updated. This means specifying [Dimensions]
in [EmbeddingGenerationOptions] or via the constructor has no effect
when using Vertex AI — the API always returns the model's default
dimensionality.
**What problem does it solve?**
When using [VertexAIEmbeddingGenerator] or
[VertexAITextEmbeddingGenerationService]with a [dimensions] value (e.g.
128), the output embedding length is the model default (e.g. 3072)
instead of the requested size.
**What scenario does it contribute to?**
Users who need to control embedding dimensionality for storage
optimization, performance, or compatibility with downstream systems when
using the Vertex AI endpoint.
Fixes: #12988
### Description
This PR adds outputDimensionality support to the Vertex AI embedding
connector, mirroring the existing Google AI implementation from PR
#10489.
The Google connector has two parallel embedding paths — Google AI (uses
API key, calls generativelanguage.googleapis.com) and Vertex AI (uses
bearer token, calls [{location}-aiplatform.googleapis.com]). PR #10489
only wired up dimensions for the Google AI path. This PR applies the
same pattern to every layer of the Vertex AI path.
The key structural difference between the two APIs is where
outputDimensionality goes in the request JSON:
Google AI puts it per-content-item: `{ "requests": [{ "content": {...},
"outputDimensionality": 128 }] }`
Vertex AI puts it in the shared parameters block: `{ "instances": [...],
"parameters": { "autoTruncate": false, "outputDimensionality": 128 } }`
The implementation follows this difference. In
[VertexAIEmbeddingRequest], outputDimensionality is added to the
existing [RequestParameters] class (alongside autoTruncate), rather than
on each instance item.
Dimensions flow through the same chain as Google AI:
1. Extension methods accept int? dimensions = null and pass it to the
generator/service constructor
2. [VertexAIEmbeddingGenerator] passes it to
[VertexAITextEmbeddingGenerationService]
3. The service passes it to [VertexAIEmbeddingClient], which stores it
as a default
4. At request time, the client resolves the final value as
[options?.Dimensions ?? this._dimensions] — runtime
[EmbeddingGenerationOptions] take priority over the constructor default
5. [VertexAIEmbeddingRequest.FromData()] sets it on the parameters
block, and [JsonIgnore(WhenWritingNull)] ensures it's omitted when not
specified
All new parameters default to null, preserving full backward
compatibility.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
---------
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: abbottdev <[email protected]>
Co-authored-by: westey <[email protected]>
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
Bumps core AI SDK dependencies to their latest versions to pick up new
features and fixes.
### Description
Updates the following packages in `Directory.Packages.props`:
- **OpenAI** 2.8.0 → 2.9.1
- **Azure.AI.OpenAI** 2.8.0-beta.1 → 2.9.0-beta.1
- **Azure.AI.Projects** 1.1.0 → 2.0.0-beta.2
- **Azure.Identity** 1.17.1 → 1.19.0 (cascading dependency from
Azure.AI.Projects 2.0.0-beta.2)
- **Microsoft.Extensions.AI\*** 10.3.0 → 10.4.0
- **System.Text.Json, System.Numerics.Tensors,
Microsoft.Extensions.Logging.Abstractions,
Microsoft.Bcl.AsyncInterfaces, System.Threading.Channels** → 10.0.4
Addresses the following breaking changes introduced by OpenAI 2.9.1:
- `CreateInputImagePart` BinaryData overload removed (replaced with data
URI approach)
- Realtime API type renames (`ConversationTool` → `RealtimeTool`,
`ConversationSessionOptions` → `RealtimeConversationSessionOptions`,
etc.)
- `ResponsesClient` constructor no longer accepts a model parameter;
model is now specified on `CreateResponseOptions.Model`
- `ResponseResult.Instructions` is now read-only
Code changes to adapt:
- Added `ModelId` property to `OpenAIResponseAgent` and propagated it
through `ResponseCreationOptionsFactory`
- Updated unit tests (`BaseOpenAIResponseClientTest`,
`OpenAIResponseAgentExtensionsTests`, `OpenAIResponseExtensionsTests`)
- Updated integration tests (`OpenAIResponseAgentTests`,
`OpenAIResponseAgentFixture`)
- Updated `BaseResponsesAgentTest` and `GettingStartedWithAgents`
samples
- Updated `AgentFrameworkMigration` samples (`GetResponsesClient`,
`AsIChatClient`, `CreateAIAgent`, modelId propagation)
- Rewrote `OpenAIRealtime` demo for the restructured Realtime API event
model
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
<!-- START COPILOT CODING AGENT TIPS -->
---
📍 Connect Copilot coding agent with [Jira](https://gh.io/cca-jira-docs),
[Azure Boards](https://gh.io/cca-azure-boards-docs) or
[Linear](https://gh.io/cca-linear-docs) to delegate work to Copilot in
one click without leaving your project management tool.
---------
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: stephentoub <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Roger Barreto <[email protected]>
### Motivation and Context
Improve control and security settings for WebFileDownloadPlugin
- Change AllowedDomains and AllowedFolders defaults from null
(allow-all) to empty (deny-all)
- Change DisableFileOverwrite default to true
- Set MaximumDownloadSize default to 10 MB
- Add path canonicalization via Path.GetFullPath() to prevent directory
traversal
- Switch folder matching from exact to prefix-based with separator
handling
- Fix fileMode variable not being used in FileStream constructor
- Add XML doc security remarks to all three plugins
- Update tests for new defaults
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Improve control and security settings for DocumentPlugin, addressing the
same class of vulnerability (arbitrary file read/write via AI agent
indirect prompt injection) that was patched in SessionsPythonPlugin.
DocumentPlugin previously had **zero security controls** at the plugin
level. Both `ReadTextAsync` and `AppendTextAsync` accepted arbitrary
file paths, delegating directly to `LocalFileSystemConnector` which
calls `File.Open(Environment.ExpandEnvironmentVariables(filePath))` with
no validation.
### Description
- Add `AllowedDirectories` property with deny-by-default (empty HashSet,
no directories allowed)
- Add `IsFilePathAllowed` private method with:
- `Path.GetFullPath()` canonicalization to prevent `../` directory
traversal
- UNC path rejection
- Fully qualified path enforcement
- Prefix matching with directory separator for subdirectory support
- Gate both `ReadTextAsync` and `AppendTextAsync` with path validation
- Add security XML doc remarks documenting secure-by-default behavior
### Tests
- Updated 4 existing tests to configure `AllowedDirectories`
- Added 6 new security tests:
- Deny-by-default (empty AllowedDirectories blocks all paths)
- Path traversal prevention (`../../` canonicalized and rejected)
- UNC path rejection
- Disallowed folder rejection
- Subdirectory prefix matching (subdirectories of allowed folders
succeed)
- Relative path rejection
All 10 DocumentPlugin tests pass.
### Breaking Change
**Yes** — `DocumentPlugin` now denies all file operations by default.
Users must explicitly configure `AllowedDirectories` before any
read/write operations will succeed:
```csharp
var plugin = new DocumentPlugin(documentConnector, fileSystemConnector)
{
AllowedDirectories = ["/path/to/allowed/folder"]
};
```
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
With Qdrant server 1.17 Embeddings stopped being returned.
Fixes#13587
### Description
The `VectorOutput.Data` property became deprecated in `Qdrant.Client`
1.17. The alternative is to use `VectorOutput.Dense.Data` instead or
`VectorOutput.GetDenseVector()` (from `Qdrant.Client` 1.16.0 or later).
Since the `.Dense` already exyists in `Qdrant.Client` 1.15.1 that is
used by the current connector, I used these. The `.GetDenseVector()`
also returns nullable `DenseVector`, so I was unsure how to handle in
context of Semantic Kernel, as as far as I see it Semantic Kernel only
supports Dense Vectors (the other two are `.Sparse` for sparse vectors
and `.MultiDense`).
So this may need special handling in future to throw an exception, when
the server returns one of the other two vector types and not dense
vectors.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
I'm currently unable (or rather I don't know how) to run the local
integration/unit tests against the qdrant database. But I validated the
change in my personal project mentioned in #13587 by directly
referencing the connector in my project and it correctly returned the
vectors on the sample code where it failed previously
```csharp
VectorStoreCollection<ulong, VectorModels.Project> projects = await GetProjectsCollection();
VectorModels.Project? project = await projects.GetAsync((ulong)projectId, new()
{
IncludeVectors = true
});
// project at this poind hat 0 sized Embedding property
if (project is null)
{
return;
}
await projects.UpsertAsync(project);
```
---------
Co-authored-by: westey <[email protected]>
### Motivation and Context
- Update default image model from dall-e-2 to gpt-image-1 in ClientCore
and OpenAITextToImageService
- Handle base64 responses in GenerateImageAsync (gpt-image-1 returns
base64 only, no URLs)
- Add Medium, Low, and Auto quality options to GetGeneratedImageQuality
- Update AzureOpenAI integration tests to use api-version
2025-04-01-preview
- Remove URL-specific assertions since gpt-image-1 returns base64 only
- Update OpenAI integration tests to reference gpt-image-1
- Update testsettings.json defaults from Dalle3/dall-e-2 to gpt-image-1
- Update OpenAITextToImageExecutionSettings XML docs for gpt-image-1
Co-authored-by: Copilot <[email protected]>
## Summary
Update NuGet package dependencies to address
[CVE-2026-26127](https://github.com/advisories/GHSA-73j8-2gch-69rq), a
high severity denial of service vulnerability caused by an out of bounds
read during malformed Base64Url decoding.
This mirrors the fix applied in Agent Framework [PR
#4647](https://github.com/microsoft/agent-framework/pull/4647).
### Package Updates (Directory.Packages.props)
| Package | Old Version | New Version |
|---------|-------------|-------------|
| Microsoft.Bcl.Memory | 10.0.2 | 10.0.4 |
| Microsoft.Bcl.AsyncInterfaces | 10.0.3 | 10.0.4 |
| System.Linq.AsyncEnumerable | 10.0.2 | 10.0.4 |
### Transitive Vulnerability Fix
Added direct `PackageReference` to `Microsoft.Bcl.Memory` in 3 projects
that transitively pulled in the vulnerable 9.0.4 version via
`Microsoft.ML.Tokenizers.Data.Cl100kBase`. The direct reference forces
NuGet to resolve the centrally managed 10.0.4 version instead.
Affected projects:
- `SemanticKernel.UnitTests`
- `IntegrationTests`
- `Concepts` (sample)
### Validation
- `dotnet restore` completes with zero vulnerability warnings
- `dotnet build` succeeds with zero errors
### Motivation and Context
When loading OpenAPI specifications, the SDK uses the `servers[].url`
field to construct HTTP request targets. This PR adds an opt-in
mechanism for consumers to validate and restrict which URLs the OpenAPI
plugin is allowed to call at runtime.
### Description
Introduces `RestApiOperationServerUrlValidationOptions`, a new options
class that can be configured via
`OpenApiFunctionExecutionParameters.ServerUrlValidationOptions` to
control outbound request targets:
- **AllowedSchemes** (`IReadOnlyList\<string\>?`) — restricts which URI
schemes are permitted. When null/empty, defaults to `https` only.
- **AllowedBaseUrls** (`IReadOnlyList\<Uri\>?`) — restricts requests to
URLs matching one of the specified base URL prefixes. When null, no base
URL restriction is applied.
Validation is performed in `RestApiOperationRunner` before any HTTP
request is sent. When `ServerUrlValidationOptions` is not set (default),
behavior is unchanged — no validation is performed.
### Changes
- New class: `RestApiOperationServerUrlValidationOptions`
- `OpenApiFunctionExecutionParameters`: added
`ServerUrlValidationOptions` property (`[Experimental("SKEXP0040")]`)
- `RestApiOperationRunner`: added `ValidateUrl()` with scheme and base
URL checks
- `OpenApiKernelPluginFactory`: wires validation options through to the
runner
- 7 new unit tests covering scheme blocking, base URL allowlisting, and
mixed configurations
### Usage Example
```csharp
var plugin = await kernel.ImportPluginFromOpenApiAsync(
pluginName: "myApi",
filePath: specPath,
executionParameters: new OpenApiFunctionExecutionParameters
{
ServerUrlValidationOptions = new RestApiOperationServerUrlValidationOptions
{
AllowedBaseUrls = [new Uri("https://api.example.com")],
AllowedSchemes = ["https"]
}
});
```
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass
- [x] New unit tests added
---------
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
---------
Co-authored-by: Alexander Zarei <[email protected]>
Co-authored-by: Alexander Zarei <[email protected]>
Co-authored-by: Chris <[email protected]>
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
Updates Microsoft.Extensions.AI packages to latest stable releases
(10.3.0) and OpenAI SDK to 2.8.0. The new versions require transitive
dependency updates and fixing breaking type renames in the OpenAI
Responses API. Additionally, the new `ChatOptions.Reasoning` property is
now mapped from `PromptExecutionSettings` and used in samples instead of
`RawRepresentationFactory`.
### Description
**Package Updates:**
- `Microsoft.Extensions.AI` and `Microsoft.Extensions.AI.Abstractions`:
10.2.0 → 10.3.0
- `Microsoft.Extensions.AI.OpenAI`: 10.0.1-preview → 10.3.0 (stable)
- `OpenAI`: 2.7.0 → 2.8.0
- `Azure.AI.OpenAI`: 2.7.0-beta.2 → 2.8.0-beta.1
- Transitive dependencies → 10.0.3:
- `System.Text.Json`
- `System.Numerics.Tensors`
- `Microsoft.Extensions.Logging.Abstractions`
- `Microsoft.Bcl.AsyncInterfaces`
- `System.Threading.Channels`
**OpenAI 2.8.0 Breaking Changes Fixed (~23 files):**
- `OpenAIResponseClient` → `ResponsesClient`
- `ResponseCreationOptions` → `CreateResponseOptions`
- `OpenAIResponse` → `ResponseResult`
- `GetOpenAIResponseClient()` → `GetResponsesClient()`
- API: Input items now passed via `CreateResponseOptions.InputItems`
instead of separate parameter
- API: `StreamingEnabled = true` required for streaming calls
- `OpenAIResponsesModelFactory` removed → using public constructors in
tests
**ChatOptions.Reasoning Mapping:**
- Added `reasoning_effort` → `ChatOptions.Reasoning.Effort` mapping in
`PromptExecutionSettingsExtensions.ToChatOptions`, supporting `low`,
`medium`, `high`, and `xhigh` (→ ExtraHigh) effort levels per OpenAI API
documentation
- Replaced `RawRepresentationFactory` with `ChatOptions.Reasoning` in
the OpenAI and AzureOpenAI Step02_ReasoningModel sample files
- Updated migration documentation in
`.github/upgrades/prompts/SemanticKernelToAgentFramework.md` to use
`TruncationMode` as the provider-specific options example (since
reasoning now has a direct `ChatOptions` equivalent)
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
<!-- START COPILOT CODING AGENT TIPS -->
---
💡 You can make Copilot smarter by setting up custom instructions,
customizing its development environment and configuring Model Context
Protocol (MCP) servers. Learn more [Copilot coding agent
tips](https://gh.io/copilot-coding-agent-tips) in the docs.
---------
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: stephentoub <[email protected]>
Co-authored-by: Roger Barreto <[email protected]>
Co-authored-by: Copilot <[email protected]>
We have the model building option SupportsMultipleKeys to allow multiple
(composite) keys, but no provider uses them at this point (note that
Cosmos NoSQL has a sort of composite key - document + partition key, but
does not go through this support in any case).
Removing this - we can always add it when we actually need to support it
(and providers aren't blocked from implementing composite keys if they
really want to).
### Motivation and Context
Bumps external `Microsoft.SemanticKernel` package references to the
latest released version 1.71.0.
### Description
- Updated `dotnet/Directory.Packages.props`:
- `Microsoft.SemanticKernel.Abstractions`: `1.70.0` → `1.71.0`
- `Microsoft.SemanticKernel.Connectors.OpenAI`: `1.70.0` → `1.71.0`
- `Microsoft.SemanticKernel.Core`: `1.70.0` → `1.71.0`
> `Microsoft.SemanticKernel.Planners.OpenAI` remains pinned at
`1.47.0-preview` (separate versioning scheme). `nuget-package.props`
already had `VersionPrefix=1.71.0` (packages produced by this repo) with
`PackageValidationBaselineVersion=1.70.0` (previous stable baseline) —
no changes needed there.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
<!-- START COPILOT ORIGINAL PROMPT -->
<details>
<summary>Original prompt</summary>
>
> ----
>
> *This section details on the original issue you should resolve*
>
> <issue_title>Update Microsoft.SemanticKerne packages to
1.71.0</issue_title>
> <issue_description>
> Update dollowing dependencies to use version 1.71.0
>
> <PackageVersion Include="Microsoft.SemanticKernel.Abstractions"
Version="1.70.0" />
> <PackageVersion Include="Microsoft.SemanticKernel.Connectors.OpenAI"
Version="1.70.0" />
> <PackageVersion Include="Microsoft.SemanticKernel.Core"
Version="1.70.0" /></issue_description>
>
> ## Comments on the Issue (you are @copilot in this section)
>
> <comments>
> </comments>
>
</details>
<!-- START COPILOT CODING AGENT SUFFIX -->
- Fixesmicrosoft/semantic-kernel#13570
<!-- START COPILOT CODING AGENT TIPS -->
---
💡 You can make Copilot smarter by setting up custom instructions,
customizing its development environment and configuring Model Context
Protocol (MCP) servers. Learn more [Copilot coding agent
tips](https://gh.io/copilot-coding-agent-tips) in the docs.
---------
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: markwallace-microsoft <[email protected]>
This is a sizable cleanup/redo of large chunks of the Cosmos NoSQL
provider; I've broken it down to three commits for easier reviewing.
* Cosmos NoSQL collections can now have either string/Guid as their key,
or CosmosNoSqlKey. In the former case, this configures the partition key
to be the same as the string/Guid document key - this is a sensible
default that's common (and encouraged) in Cosmos. All other scenarios
require CosmosNoSqlKey:
* A single partition key that isn't the document ID
* A hierarchical partition key (more than one property)
* No partition key (legacy/discouraged)
* Note that CosmosNoSqlKey is only passed to GetAsync and DeleteAsync;
on the user's .NET record type, the properties are there as usual (e.g.
a string document Id property, an int partition key property). This
introduces a discrepancy for the first time between the collection's
TKey (CosmosNoSqlKey) and its actual key property on the .NET type (a
string); this made some things trickier, but is the correct way to do
things for composite key cases (we'd do the same if we implement
composite keys for relational providers).
* Added support for Cosmos hierarchical partition keys (2-3 properties
instead of just one).
* GetAsync no longer does a SQL query with a WHERE clause, but rather an
efficient point read via ReadItem. The multiple-key overload does
ReadManyItemsAsync, which again is far more efficient.
* UpdateAsync and DeleteAsync now correctly supply the partition key in
the call's request options, again making it much more efficient.
* Various other cleanup and fixes all around.
DateTime now maps to the PG timestamptz type by default, which
represents a UTC timestamp; this aligns with Npgsql and EF Core.
However, now that we have property annotations, I've also added a new
`WithStoreType()` that allows the user to specify a database type
explicitly. For now, this is only supported for setting `timestamp with
time zone` (short: `timestamp`), which is the other PG date/time type,
for unspecified timestamps (timezone is unknown or implicitly assumed).
This allows users who do want to store non-UTC timestamp to do so.
Closes#10641
### Motivation and Context
Updates Semantic Kernel package references to align with the latest
1.70.0 release.
### Description
Updated three package versions in `dotnet/Directory.Packages.props`:
- `Microsoft.SemanticKernel.Abstractions`: 1.68.0 → 1.70.0
- `Microsoft.SemanticKernel.Connectors.OpenAI`: 1.68.0 → 1.70.0
- `Microsoft.SemanticKernel.Core`: 1.68.0 → 1.70.0
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
<!-- START COPILOT ORIGINAL PROMPT -->
<details>
<summary>Original prompt</summary>
>
> ----
>
> *This section details on the original issue you should resolve*
>
> <issue_title>Update the Microsoft.SemanticKernel packages from 1.68.0
to 1.70.0</issue_title>
> <issue_description>In this file
`https://github.com/microsoft/semantic-kernel/blob/main/dotnet/Directory.Packages.props`
>
> Update the Microsoft.SemanticKernel packages from 1.68.0 to 1.70.0
> </issue_description>
>
> <agent_instructions>Update the Microsoft.SemanticKernel packages from
1.68.0 to 1.70.0</agent_instructions>
>
> ## Comments on the Issue (you are @copilot in this section)
>
> <comments>
> </comments>
>
</details>
<!-- START COPILOT CODING AGENT SUFFIX -->
- Fixesmicrosoft/semantic-kernel#13523
<!-- START COPILOT CODING AGENT TIPS -->
---
💡 You can make Copilot smarter by setting up custom instructions,
customizing its development environment and configuring Model Context
Protocol (MCP) servers. Learn more [Copilot coding agent
tips](https://gh.io/copilot-coding-agent-tips) in the docs.
---------
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: markwallace-microsoft <[email protected]>
For providers which don't natively support score threshold, I've gone
with applying the filter client-side - the other option would be to
throw.
* In EF we're quite strict on not bringing back database data in order
to client-evaluate; in other words, if the user wants to load database
rows from the database and then perform some post-filtering, they need
to write that explicitly in code, to avoid scenarios where tons of data
gets unintentionally transferred.
* In MEVD we already implement Skip in various providers by bringing
back the entire matching resultset and then filtering client-side. This
is potentially much worse than filtering for score threshold
client-side, as the amount of extra data brought back by threshold
post-filtering is limited to top (k), whereas with Skip/pagination
queries that amount of data grows with each page.
* Ultimately, MEVD is simpler and more high-level, and is also
explicitly designed for layers to be composed on top (e.g. MEDI). So
there does seem to be more value in features "just working" across
providers.
Closes#9566
Overriding merge checks as there are unrelated Python integration test failures
### Motivation and Context
- Uploads: Require both EnableDangerousFileUploads = true AND
AllowedUploadDirectories configured
- Downloads: Permissive by default, but if AllowedDownloadDirectories is
configured, path validation
applies
- Both use path canonicalization to prevent traversal attacks
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
* Adds IsAutoGenerated to key property definition and attribute.
* When auto-generation is on, saving a record where the key property is
the default (empty GUID, zero integer) triggers the auto-generation.
It's still possible to set the key property to a non-default value,
overriding the auto-generation.
* Auto-generation can happen in the database (mainly on the relational
databases), or on the cilent side (Guid.NewGuid()).
* IsAutoGenerated is null by default, meaning that the provider decides
whether to turn on autogeneration by default, based on the property
type. This means that GUID properties are always auto-generated by
default (if the key property is left unassigned), and int/long
properties are auto-generated on relational providers. This aligns with
the behavior in Entity Framework.
* All providers support GUID generation, by doing it on the client
before sending the record (Guid.NewGuid()). Some providers have special
behavior, e.g. PG generates UUIDv7 and SQL Server generates sequential
IDs in the database (much better for indexing). Universal GUID
auto-generation makes things much simpler for upper layers, specifically
Microsoft.Extensions.DataIngestion.
Closes#11485
westey