mirror of
https://github.com/microsoft/semantic-kernel.git
synced 2026-10-12 02:19:06 +00:00
22ee3e00323fad1d27dccb6b1b1e67163e6c4416
1266
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 dependabot[bot]
|
22ee3e0032 |
Python: Bump authlib from 1.6.11 to 1.6.12 in /python (#14004)
Bumps [authlib](https://github.com/authlib/authlib) from 1.6.11 to 1.6.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/authlib/authlib/releases">authlib's releases</a>.</em></p> <blockquote> <h2>v1.6.12</h2> <ul> <li> <ul> <li>Fix redirecting to unvalidated <code>redirect_uri</code> on <code>InvalidScopeError</code> in <code>OpenIDImplicitGrant</code> and <code>OpenIDHybridGrant</code>. <strong>Full Changelog</strong>: <a href="https://github.com/authlib/authlib/compare/v1.6.11...v1.6.12">https://github.com/authlib/authlib/compare/v1.6.11...v1.6.12</a></li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/authlib/authlib/blob/1.6.12/docs/changelog.rst">authlib's changelog</a>.</em></p> <blockquote> <h2>Version 1.6.12</h2> <p><strong>Released on may 4, 2026</strong></p> <ul> <li>Fix redirecting to unvalidated <code>redirect_uri</code> on <code>InvalidScopeError</code> in <code>OpenIDImplicitGrant</code> and <code>OpenIDHybridGrant</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/authlib/authlib/commit/e46e515b3a87ea63ab0606b248d75f69d83a2391"><code>e46e515</code></a> chore: bump to 1.6.12</li> <li><a href="https://github.com/authlib/authlib/commit/9babc131e13b018a267ae78747cba7caa6dfb7d5"><code>9babc13</code></a> fix: redirecting to unvalidated redirect_uri on InvalidScopeError in OIDC grants</li> <li>See full diff in <a href="https://github.com/authlib/authlib/compare/v1.6.11...1.6.12">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
326ecbecd9 |
Python: Bump idna from 3.11 to 3.15 in /python (#14024)
Bumps [idna](https://github.com/kjd/idna) from 3.11 to 3.15. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/kjd/idna/blob/master/HISTORY.md">idna's changelog</a>.</em></p> <blockquote> <h2>3.15 (2026-05-12)</h2> <ul> <li>Enforce DNS-length cap on individual labels early in <code>check_label</code>, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.</li> <li>Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared <code>_unicode_dots_re</code> from <code>idna.core</code> in the codec module.</li> <li>Use <code>raise ... from err</code> for proper exception chaining and switch internal string formatting to f-strings.</li> <li>Allow <code>flit_core</code> 4.x in the build backend.</li> <li>Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.</li> <li>Add Dependabot configuration for GitHub Actions.</li> <li>Convert README and HISTORY from reStructuredText to Markdown.</li> <li>Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.</li> </ul> <p>Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.</p> <h2>3.14 (2026-05-10)</h2> <ul> <li>Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]</li> </ul> <p>Thanks to Stan Ulbrych for reporting the issue.</p> <h2>3.13 (2026-04-22)</h2> <ul> <li>Correct classification error for codepoint U+A7F1</li> </ul> <h2>3.12 (2026-04-21)</h2> <ul> <li>Update to Unicode 17.0.0.</li> <li>Issue a deprecation warning for the transitional argument.</li> <li>Added lazy-loading to provide some performance improvements.</li> <li>Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.</li> </ul> <p>Thanks to Rodrigo Nogueira for contributions to this release.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8"><code>af30a09</code></a> Release 3.15</li> <li><a href="https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2"><code>30314d4</code></a> Pre-release 3.15rc0</li> <li><a href="https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9"><code>05d4b21</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/237">#237</a> from kjd/convert-docs-to-markdown</li> <li><a href="https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee"><code>2987fdb</code></a> Convert README and HISTORY from reStructuredText to Markdown</li> <li><a href="https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c"><code>59fa800</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/236">#236</a> from kjd/dependabot/github_actions/actions-f3e34333ea</li> <li><a href="https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2"><code>def6983</code></a> Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea</li> <li><a href="https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631"><code>bbd8004</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/234">#234</a> from StanFromIreland/patch-1</li> <li><a href="https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc"><code>edd07c0</code></a> Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group</li> <li><a href="https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123"><code>5557db0</code></a> Merge branch 'master' into patch-1</li> <li><a href="https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d"><code>f11746c</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/235">#235</a> from StanFromIreland/patch-2</li> <li>Additional commits viewable in <a href="https://github.com/kjd/idna/compare/v3.11...v3.15">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
f6f47a298c |
Bump pyarrow from 21.0.0 to 23.0.1 in /python (#14058)
Bumps [pyarrow](https://github.com/apache/arrow) from 21.0.0 to 23.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/arrow/releases">pyarrow's releases</a>.</em></p> <blockquote> <h2>Apache Arrow 23.0.1</h2> <p>Release Notes URL: <a href="https://arrow.apache.org/release/23.0.1.html">https://arrow.apache.org/release/23.0.1.html</a></p> <h2>Apache Arrow 23.0.1 RC0</h2> <p>Release Notes: Release Candidate: 23.0.1 RC0</p> <h2>Apache Arrow 23.0.0</h2> <p>Release Notes URL: <a href="https://arrow.apache.org/release/23.0.0.html">https://arrow.apache.org/release/23.0.0.html</a></p> <h2>Apache Arrow 23.0.0 RC2</h2> <p>Release Notes: Release Candidate: 23.0.0 RC2</p> <h2>Apache Arrow 22.0.0</h2> <p>Release Notes URL: <a href="https://arrow.apache.org/release/22.0.0.html">https://arrow.apache.org/release/22.0.0.html</a></p> <h2>Apache Arrow 22.0.0 RC1</h2> <p>Release Notes: Release Candidate: 22.0.0 RC1</p> <h2>Apache Arrow 22.0.0 RC0</h2> <p>Release Notes: Release Candidate: 22.0.0 RC0</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/arrow/commit/82a374e5f3de5b744f26591e6cd96de6349c76d9"><code>82a374e</code></a> MINOR: [Release] Update versions for 23.0.1</li> <li><a href="https://github.com/apache/arrow/commit/c1ae37c4a597f466b1806e65a9e011be1060dfc5"><code>c1ae37c</code></a> MINOR: [Release] Update .deb/.rpm changelogs for 23.0.1</li> <li><a href="https://github.com/apache/arrow/commit/8f6e55736f60f1f95aee1e8765c6b75ad9589111"><code>8f6e557</code></a> MINOR: [Release] Update CHANGELOG.md for 23.0.1</li> <li><a href="https://github.com/apache/arrow/commit/4e16a1aeed83a65e6b49556c2fed8e9061cdf980"><code>4e16a1a</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49159">GH-49159</a>: [C++][Gandiva] Detect overflow in repeat() (<a href="https://redirect.github.com/apache/arrow/issues/49160">#49160</a>)</li> <li><a href="https://github.com/apache/arrow/commit/985621dbfcf3fd2061889e43c50b59825df84f3f"><code>985621d</code></a> <a href="https://redirect.github.com/apache/arrow/issues/48817">GH-48817</a> [R][C++] Bump C++20 in R build infrastructure (<a href="https://redirect.github.com/apache/arrow/issues/48819">#48819</a>)</li> <li><a href="https://github.com/apache/arrow/commit/1bea06ad4e14d75dd97a78a0148cd9cf6f4df0bc"><code>1bea06a</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49024">GH-49024</a>: [CI] Update Debian version in <code>.env</code> (<a href="https://redirect.github.com/apache/arrow/issues/49032">#49032</a>)</li> <li><a href="https://github.com/apache/arrow/commit/147bcd6d8f3fef05dd06968d3b60c17721c60334"><code>147bcd6</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49156">GH-49156</a>: [Python] Require GIL for string comparison (<a href="https://redirect.github.com/apache/arrow/issues/49161">#49161</a>)</li> <li><a href="https://github.com/apache/arrow/commit/e4f922b1621b6c833f583cf26500f115ab5bc483"><code>e4f922b</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49138">GH-49138</a>: [Packaging][Python] Remove nightly cython install from manylinux wh...</li> <li><a href="https://github.com/apache/arrow/commit/f9376e4721b81bad9fe3fe840926a3283f95ee30"><code>f9376e4</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49003">GH-49003</a>: [C++] Don't consider <code>out_of_range</code> an error in float parsing (<a href="https://redirect.github.com/apache/arrow/issues/49095">#49095</a>)</li> <li><a href="https://github.com/apache/arrow/commit/ab2c0ad6b23d05d5f77fc8a34d5a1c4baaacb0a4"><code>ab2c0ad</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49044">GH-49044</a>: [CI][Python] Fix test_download_tzdata_on_windows by adding required...</li> <li>Additional commits viewable in <a href="https://github.com/apache/arrow/compare/apache-arrow-21.0.0...apache-arrow-23.0.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]andGitHub Copilot
|
03f73aee5e |
Python: Bump torch from 2.8.0 to 2.12.0 in /python (#14065)
Bumps [torch](https://github.com/pytorch/pytorch) from 2.8.0 to 2.12.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pytorch/pytorch/releases">torch's releases</a>.</em></p> <blockquote> <h1>PyTorch 2.12.0 Release Notes</h1> <ul> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#highlights">Highlights</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes">Backwards Incompatible Changes</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#deprecations">Deprecations</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#new-features">New Features</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#improvements">Improvements</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes">Bug fixes</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#performance">Performance</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#documentation">Documentation</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#developers">Developers</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#security">Security</a></li> </ul> <h1>Highlights</h1> <!-- raw HTML omitted --> <p>For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.</p> <h1>Backwards Incompatible Changes</h1> <h2>Build Frontend</h2> <ul> <li> <p>Strengthened SVE compile checks in <code>FindARM.cmake</code>, which may reject previously accepted but incorrect SVE configurations (<a href="https://redirect.github.com/pytorch/pytorch/pull/176646">#176646</a>)</p> <p>Source builds that enable SVE now validate the compiler configuration more strictly. If a build previously passed with an incomplete or mismatched SVE setup, it may now fail during CMake configuration instead of later in compilation. Update the compiler/toolchain flags so they accurately describe the target SVE support, or disable SVE for that build.</p> </li> <li> <p>Updated the minimum CUDA version required to build PyTorch from source to CUDA 12.6 (<a href="https://redirect.github.com/pytorch/pytorch/pull/178925">#178925</a>)</p> <p>Building PyTorch from source with CUDA versions older than 12.6 is no longer supported. Users building custom binaries should install CUDA 12.6 or newer and make sure <code>CUDA_HOME</code> points to that installation.</p> <p>Version 2.11:</p> <pre lang="bash"><code>CUDA_HOME=/usr/local/cuda-12.4 python setup.py develop </code></pre> <p>Version 2.12:</p> <pre lang="bash"><code>CUDA_HOME=/usr/local/cuda-12.6 python setup.py develop </code></pre> </li> <li> <p>Enforced a C++20 minimum in CMake build files (<a href="https://redirect.github.com/pytorch/pytorch/pull/178662">#178662</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pytorch/pytorch/commit/0d62256a2b23365f8e1604297eb23a6545102aa8"><code>0d62256</code></a> [release] Dockerfile: skip torchaudio install when CUDA_PATH=cu132 (<a href="https://redirect.github.com/pytorch/pytorch/issues/183346">#183346</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/7661cd9c6b841b62b7f411aa52ec51f05457263b"><code>7661cd9</code></a> [MPS] Fix SDPA wrong output for permuted q/k/v with B > 1 (<a href="https://redirect.github.com/pytorch/pytorch/issues/181886">#181886</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/9da6087ab64ab6a2118686420ca5353c90dd7e1f"><code>9da6087</code></a> Fix stale PYTORCH_RELEASES_CODE_CC dict (fixes <a href="https://redirect.github.com/pytorch/pytorch/issues/182250">#182250</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182369">#182369</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/e4c37cc011d47246ce8ea4b99c9b28fb7f400224"><code>e4c37cc</code></a> Avoid raw stream name collisions in Inductor (<a href="https://redirect.github.com/pytorch/pytorch/issues/182178">#182178</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/822d047dc8dd8d919f83c3ad5c786e405075d1f0"><code>822d047</code></a> [MPS] Fix bool mask handling in 1-pass SDPA decode kernel (<a href="https://redirect.github.com/pytorch/pytorch/issues/182285">#182285</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182311">#182311</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/5c5e523cd520e6986006e45be243b3ee927ea546"><code>5c5e523</code></a> Add enable_gqa parameter to SDPA MPS meta registration (<a href="https://redirect.github.com/pytorch/pytorch/issues/181550">#181550</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/eece52ead16886e5463c3dcee9b04db783cc68d5"><code>eece52e</code></a> [AOTI] Add BC-safe c_shim v2 for _scaled_dot_product_attention_math_for_mps e...</li> <li><a href="https://github.com/pytorch/pytorch/commit/b39330bbe210b9628207e84d8ba2cabb7975fbac"><code>b39330b</code></a> [Inductor] Call latest c_shim version for versioned fallback ops (<a href="https://redirect.github.com/pytorch/pytorch/issues/181548">#181548</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/06f10d088229a25ac52bd14b6cacc04a4161f6ca"><code>06f10d0</code></a> Revert "[FSDP2] add fqn to communication ops" (<a href="https://redirect.github.com/pytorch/pytorch/issues/182100">#182100</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182157">#182157</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/449e3393139a1aca9afec120c9a63f98f12d55b0"><code>449e339</code></a> Revert "[Inductor] Improve materialization heuristic for a chain of computaio...</li> <li>Additional commits viewable in <a href="https://github.com/pytorch/pytorch/compare/v2.8.0...v2.12.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: GitHub Copilot <[email protected]> |
||
|
dependabot[bot]andcopilot-swe-agent[bot]
|
91efa2120c |
Python: Bump bleach from 6.3.0 to 6.4.0 in /python (#14089)
Bumps [bleach](https://github.com/mozilla/bleach) from 6.3.0 to 6.4.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/mozilla/bleach/blob/main/CHANGES">bleach's changelog</a>.</em></p> <blockquote> <h2>Version 6.4.0 (June 5th, 2026)</h2> <p><strong>NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues.</strong> See issue: <code><https://github.com/mozilla/bleach/issues/698></code>__</p> <p><strong>Backwards incompatible changes</strong></p> <ul> <li>Dropped support for pypy 3.10. (<a href="https://redirect.github.com/mozilla/bleach/issues/764">#764</a>)</li> </ul> <p><strong>Security fixes</strong></p> <ul> <li> <p>Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.</p> <p>Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.</p> <p>For example::</p> <p>import bleach payload1 = '<!-- raw HTML omitted -->Click<!-- raw HTML omitted -->' result1 = bleach.clean(payload1) print(repr(result1))</p> <p>outputs::</p> <p>'<!-- raw HTML omitted -->Click<!-- raw HTML omitted -->'</p> <p>See the advisory for details.</p> </li> <li> <p>Fix GHSA-gj48-438w-jh9v.</p> <p>Fix issue where URI sanitization wasn't happening in formaction attributes.</p> <p>See the advisory for details.</p> </li> </ul> <p><strong>Bug fixes</strong></p> <ul> <li> <p>Add support for pypy 3.11. (<a href="https://redirect.github.com/mozilla/bleach/issues/764">#764</a>)</p> </li> <li> <p>Drop version max in tinycss2 pin. (<a href="https://redirect.github.com/mozilla/bleach/issues/772">#772</a>)</p> <p>This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mozilla/bleach/commit/f0355a7af00500482c5292c6c83290c6a178068d"><code>f0355a7</code></a> fix: fix last release date in CHANGES</li> <li><a href="https://github.com/mozilla/bleach/commit/ae4e8a26706516ad01b92e66321b480208a440da"><code>ae4e8a2</code></a> chore: bleach 6.4.0 and final release</li> <li><a href="https://github.com/mozilla/bleach/commit/970df58e9f0c55cc52244f3f0106e473a40d886d"><code>970df58</code></a> fix: uri-sanitization in formaction attributes</li> <li><a href="https://github.com/mozilla/bleach/commit/7c4867c32344d1c961107fae62240a6f0dc680dc"><code>7c4867c</code></a> fix: xss bypass in allowed protocol test using unicode invisible characters</li> <li><a href="https://github.com/mozilla/bleach/commit/913ab75992b845e2c9c060c41f24d46921db4693"><code>913ab75</code></a> fix: reduce redundancy in workflow jobs</li> <li><a href="https://github.com/mozilla/bleach/commit/218c15af455c8dec14f98fcb2e235f8680e93930"><code>218c15a</code></a> fix: rework pip caching</li> <li><a href="https://github.com/mozilla/bleach/commit/4f0b097bf80548a022050e2f71f024d755a9f154"><code>4f0b097</code></a> fix: fix tox platform restrictions</li> <li><a href="https://github.com/mozilla/bleach/commit/e95a79d07bb5d792425c2bc0ef5dd03f6614f3bb"><code>e95a79d</code></a> chore: update pytest</li> <li><a href="https://github.com/mozilla/bleach/commit/91539d4e80d4685b8f2bedc79076ff0ff6c1b911"><code>91539d4</code></a> Bump actions/cache from 5.0.3 to 5.0.4</li> <li><a href="https://github.com/mozilla/bleach/commit/cd47b4ce495859065da23c2116f651e591e1e90d"><code>cd47b4c</code></a> fix: handle left-angle-bracket that's not a tag (<a href="https://redirect.github.com/mozilla/bleach/issues/733">#733</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mozilla/bleach/compare/v6.3.0...v6.4.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> |
||
|
|
13f812b825 |
Python: Update pymongo requirement from <4.16,>=4.8.0 to >=4.8.0,<4.17 in /python (#13866)
Updates the requirements on [pymongo](https://github.com/mongodb/mongo-python-driver) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mongodb/mongo-python-driver/releases">pymongo's releases</a>.</em></p> <blockquote> <h2>PyMongo 4.16.0</h2> <p>Community notes: <!-- raw HTML omitted --></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/mongodb/mongo-python-driver/blob/master/doc/changelog.rst">pymongo's changelog</a>.</em></p> <blockquote> <h2>Changes in Version 4.16.0 (2026/01/07)</h2> <p>PyMongo 4.16 brings a number of changes including:</p> <ul> <li>Removed invalid documents from :class:<code>bson.errors.InvalidDocument</code> error messages as doing so may leak sensitive user data. Instead, invalid documents are stored in :attr:<code>bson.errors.InvalidDocument.document</code>.</li> <li>PyMongo now requires <code>dnspython>=2.6.1</code>, since <code>dnspython</code> 1.0 is no longer maintained. The minimum version is <code>2.6.1</code> to account for <code>CVE-2023-29483 <https://www.cve.org/CVERecord?id=CVE-2023-29483></code>_.</li> <li>Removed support for Eventlet. Eventlet is actively being sunset by its maintainers and has compatibility issues with PyMongo's dnspython dependency.</li> <li>Use Zstandard support from the standard library for Python 3.14+, and use <code>backports.zstd</code> for older versions.</li> <li>Fixed return type annotation for <code>find_one_and_*</code> methods on :class:<code>~pymongo.asynchronous.collection.AsyncCollection</code> and :class:<code>~pymongo.synchronous.collection.Collection</code> to include <code>None</code>.</li> <li>Added support for NumPy 1D-arrays in :class:<code>bson.binary.BinaryVector</code>.</li> <li>Prevented :class:<code>~pymongo.encryption.ClientEncryption</code> from loading the crypt shared library to fix "MongoCryptError: An existing crypt_shared library is loaded by the application" unless the linked library search path is set.</li> </ul> <h2>Changes in Version 4.15.5 (2025/12/02)</h2> <p>Version 4.15.5 is a bug fix release.</p> <ul> <li>Fixed a bug that could cause <code>AutoReconnect("connection pool paused")</code> errors when cursors fetched more documents from the database after SDAM heartbeat failures.</li> </ul> <h2>Changes in Version 4.15.4 (2025/10/21)</h2> <p>Version 4.15.4 is a bug fix release.</p> <ul> <li>Relaxed the callback type of :meth:<code>~pymongo.asynchronous.client_session.AsyncClientSession.with_transaction</code> to allow the broader Awaitable type rather than only Coroutine objects.</li> <li>Added the missing Python 3.14 trove classifier to the package metadata.</li> </ul> <p>Issues Resolved ...............</p> <p>See the <code>PyMongo 4.15.4 release notes in JIRA</code>_ for the list of resolved issues in this release.</p> <p>.. _PyMongo 4.15.4 release notes in JIRA: <a href="https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=47237">https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=47237</a></p> <h2>Changes in Version 4.15.3 (2025/10/07)</h2> <p>Version 4.15.3 is a bug fix release.</p> <ul> <li>Fixed a memory leak when raising :class:<code>bson.errors.InvalidDocument</code> with C extensions.</li> <li>Fixed the return type of the :meth:<code>~pymongo.asynchronous.collection.AsyncCollection.distinct</code>,</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/32901018ca14d9acb05004a88d65b6ab0b29c877"><code>3290101</code></a> Prepare 4.16.0 release (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2672">#2672</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/1be94d262dd0281b032b6f9e56d381cac3a7a6d9"><code>1be94d2</code></a> PYTHON-5685 Fix unified spec sync metadata for csot and sessions tests (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2669">#2669</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/6585d9cb51d5c9b2d85eec4f49b8196612d9e8ee"><code>6585d9c</code></a> PYTHON-2442: Refactor: use _asdict() in _options_dict() (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2670">#2670</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/fdb1f7ea4abe128ae4e59e3d063fd95d7daaa964"><code>fdb1f7e</code></a> PYTHON-5677 Prevent ClientEncryption from loading crypt shared library (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2659">#2659</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/0cd9763423b85cd37779ea934bf7b1f8be8bbf8e"><code>0cd9763</code></a> Bump zizmorcore/zizmor-action from cb3d8e846e148d1111d90b03375b9c03deceda37 t...</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/2f263d4d3f11eb4a2b32ace467fd2767c371f4d7"><code>2f263d4</code></a> PYTHON-5680 Fix handling of expectedDocuments in Unified Test Runner (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2665">#2665</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/e9658b2406232b6bd6ac1d961b368142f8819479"><code>e9658b2</code></a> Add 4.15.5 release date to changelog (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2666">#2666</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/10dd20405ba19c643a1b305ff84f742b19c40daf"><code>10dd204</code></a> Update coverage[toml] requirement from <=7.10.6,>=5 to >=5,<=7.10.7 (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2662">#2662</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/130067799cc671d4dcc2f34dafff73c4ef5ddeaf"><code>1300677</code></a> [Spec Resync] 12-22-2025 (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2663">#2663</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/18c1f142b5b3fd179a677b2736332dc17770b7c2"><code>18c1f14</code></a> PYTHON-5529 Introduce optin setting to await for MinPoolSize population (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2664">#2664</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mongodb/mongo-python-driver/compare/4.8.0...4.16.0">compare view</a></li> </ul> </details> <br /> You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: moonbox3 <[email protected]> |
||
|
dependabot[bot]andcopilot-swe-agent[bot]
|
356aed0986 |
Python: Bump starlette from 0.52.1 to 1.3.1 in /python (#14092)
Bumps [starlette](https://github.com/Kludex/starlette) from 0.52.1 to 1.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p> <blockquote> <h2>Version 1.3.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>StarletteDeprecationWarning</code> instead of <code>DeprecationWarning</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3119">Kludex/starlette#3119</a></li> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3329">Kludex/starlette#3329</a></li> <li>Enforce <code>FormParser</code> limits in parser callbacks by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3331">Kludex/starlette#3331</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.3.0...1.3.1">https://github.com/Kludex/starlette/compare/1.3.0...1.3.1</a></p> <h2>Version 1.3.0</h2> <h2>What's Changed</h2> <ul> <li>Clamp oversized suffix ranges in <code>FileResponse</code> by <a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files by <a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li>Add <code>httpx2</code> to the <code>full</code> extra by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3323">Kludex/starlette#3323</a></li> <li>Adjust testclient typing and warnings by <a href="https://github.com/waketzheng"><code>@waketzheng</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3322">Kludex/starlette#3322</a></li> <li>Fix IndexError in URL.replace() on a URL with no authority by <a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li>Annotate URLPath protocol parameter with Literal by <a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li>avoid collapsing exception groups from user code by <a href="https://github.com/graingert"><code>@graingert</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/2830">Kludex/starlette#2830</a></li> <li>Use <code>removeprefix</code> to strip weak ETag indicator in <code>is_not_modified</code> by <a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> <li>Build <code>request.url</code> from structured components by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3326">Kludex/starlette#3326</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li><a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li><a href="https://github.com/leestana01"><code>@leestana01</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3319">Kludex/starlette#3319</a></li> <li><a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li><a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3204">Kludex/starlette#3204</a></li> <li><a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li><a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.1...1.3.0">https://github.com/Kludex/starlette/compare/1.2.1...1.3.0</a></p> <h2>Version 1.2.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module by <a href="https://github.com/leifwar"><code>@leifwar</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li>Add assert error for requires() when request param is not Request type by <a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/leifwar"><code>@leifwar</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li><a href="https://github.com/diskeu"><code>@diskeu</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3243">Kludex/starlette#3243</a></li> <li><a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.0...1.2.1">https://github.com/Kludex/starlette/compare/1.2.0...1.2.1</a></p> <h2>Version 1.2.0</h2> <h2>What's Changed</h2> <ul> <li>Support httpx2 in the test client by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3291">Kludex/starlette#3291</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.1.0...1.2.0">https://github.com/Kludex/starlette/compare/1.1.0...1.2.0</a></p> <h2>Version 1.1.0</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p> <blockquote> <h2>1.3.1 (June 12, 2026)</h2> <h4>Fixed</h4> <ul> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> <a href="https://redirect.github.com/encode/starlette/pull/3329">#3329</a>.</li> <li>Enforce <code>FormParser</code> limits in parser callbacks <a href="https://redirect.github.com/encode/starlette/pull/3331">#3331</a>.</li> </ul> <h2>1.3.0 (June 11, 2026)</h2> <h4>Added</h4> <ul> <li>Add <code>httpx2</code> to the <code>full</code> extra <a href="https://redirect.github.com/encode/starlette/pull/3323">#3323</a>.</li> <li>Annotate the <code>URLPath</code> <code>protocol</code> parameter with <code>Literal</code> <a href="https://redirect.github.com/encode/starlette/pull/3285">#3285</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Build <code>request.url</code> from structured components <a href="https://redirect.github.com/encode/starlette/pull/3326">#3326</a>.</li> <li>Clamp oversized suffix ranges in <code>FileResponse</code> <a href="https://redirect.github.com/encode/starlette/pull/3307">#3307</a>.</li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files <a href="https://redirect.github.com/encode/starlette/pull/3191">#3191</a>.</li> <li>Avoid collapsing exception groups raised from user code <a href="https://redirect.github.com/encode/starlette/pull/2830">#2830</a>.</li> <li>Use <code>removeprefix</code> to strip the weak <code>ETag</code> indicator in <code>is_not_modified</code> <a href="https://redirect.github.com/encode/starlette/pull/3193">#3193</a>.</li> <li>Fix <code>IndexError</code> in <code>URL.replace()</code> on a URL with no authority <a href="https://redirect.github.com/encode/starlette/pull/3317">#3317</a>.</li> <li>Adjust <code>testclient</code> typing and warnings <a href="https://redirect.github.com/encode/starlette/pull/3322">#3322</a>.</li> </ul> <h2>1.2.1 (May 31, 2026)</h2> <h4>Fixed</h4> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module <a href="https://redirect.github.com/encode/starlette/pull/3304">#3304</a>.</li> <li>Add assert error for <code>requires()</code> when the request parameter is not a <code>Request</code> type <a href="https://redirect.github.com/encode/starlette/pull/3298">#3298</a>.</li> </ul> <h2>1.2.0 (May 28, 2026)</h2> <h4>Added</h4> <ul> <li>Support httpx2 in the test client <a href="https://redirect.github.com/encode/starlette/pull/3291">#3291</a>.</li> </ul> <h2>1.1.0 (May 23, 2026)</h2> <h4>Added</h4> <ul> <li>Use <code>"application/octet-stream"</code> as the <code>FileResponse</code> media type fallback <a href="https://redirect.github.com/encode/starlette/pull/3283">#3283</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Only dispatch standard HTTP verbs in <code>HTTPEndpoint</code> <a href="https://redirect.github.com/encode/starlette/pull/3286">#3286</a>.</li> <li>Reject absolute paths in <code>StaticFiles.lookup_path</code> <a href="https://redirect.github.com/encode/starlette/pull/3287">#3287</a>.</li> </ul> <h2>1.0.1 (May 21, 2026)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Kludex/starlette/commit/8ebffd0678570ddd5d5bb11c6f3c3c7fd4682ab9"><code>8ebffd0</code></a> Version 1.3.1 (<a href="https://redirect.github.com/Kludex/starlette/issues/3330">#3330</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/25b8e179d8d7ed86769c02f648772dd5fb43dc3c"><code>25b8e17</code></a> Enforce <code>FormParser</code> limits in parser callbacks (<a href="https://redirect.github.com/Kludex/starlette/issues/3331">#3331</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/dba1c4babc4f99ad2622bb913d87045775dda735"><code>dba1c4b</code></a> Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3329">#3329</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/45e51dcf99f3a270b0bcec1aec5410b4345863a9"><code>45e51dc</code></a> Use <code>StarletteDeprecationWarning</code> instead of <code>DeprecationWarning</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3119">#3119</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/5f8610c386e13de1d80d36efa961e1486a1d2d01"><code>5f8610c</code></a> Version 1.3.0 (<a href="https://redirect.github.com/Kludex/starlette/issues/3327">#3327</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/167b5850e809f38b27fbfed62d58bf6442855975"><code>167b585</code></a> Build <code>request.url</code> from structured components (<a href="https://redirect.github.com/Kludex/starlette/issues/3326">#3326</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/37309255b4c1b9c381a2d24a1eaf83100984a16a"><code>3730925</code></a> Use <code>removeprefix</code> to strip weak ETag indicator in <code>is_not_modified</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3193">#3193</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/e6f7ad1ab85efb27ab7910d8007b3f4531f7b083"><code>e6f7ad1</code></a> avoid collapsing exception groups from user code (<a href="https://redirect.github.com/Kludex/starlette/issues/2830">#2830</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/115228fcdca0e0ef5bf4a95a40ddce5a9fced428"><code>115228f</code></a> Annotate URLPath protocol parameter with Literal (<a href="https://redirect.github.com/Kludex/starlette/issues/3285">#3285</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/113f193a34353c9153857028c1074351d22fad07"><code>113f193</code></a> docs: replace inline ASGI server list with link to canonical implemen… (<a href="https://redirect.github.com/Kludex/starlette/issues/3204">#3204</a>)</li> <li>Additional commits viewable in <a href="https://github.com/Kludex/starlette/compare/0.52.1...1.3.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> |
||
|
dependabot[bot]
|
51748eecf3 |
Python: Bump pyjwt from 2.11.0 to 2.13.0 in /python (#14084)
Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.11.0 to 2.13.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.13.0</h2> <h1>PyJWT 2.13.0 — Security Release</h1> <p>This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.</p> <h2>Security</h2> <ul> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"><code>GHSA-xgmm-8j9v-c9wx</code></a> — JWK JSON accepted as HMAC secret (algorithm confusion).</strong> <code>HMACAlgorithm.prepare_key</code> previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in <code>algorithms=[…]</code> and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. <em>Reported by <a href="https://github.com/aradona91"><code>@aradona91</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f"><code>GHSA-jq35-7prp-9v3f</code></a> — Algorithm allow-list bypass with <code>PyJWK</code> / <code>PyJWKClient</code>.</strong> When verifying with a <code>PyJWK</code>, the caller's <code>algorithms=[…]</code> allow-list was checked against the token header <code>alg</code> as a string only; actual verification used the algorithm bound to the <code>PyJWK</code>. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header <code>alg</code> to match the <code>PyJWK</code>'s algorithm before verification. <em>Reported by <a href="https://github.com/sushi-gif"><code>@sushi-gif</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39"><code>GHSA-w7vc-732c-9m39</code></a> — DoS via base64 decode of unused payload segment when <code>b64=false</code>.</strong> For detached-payload JWS (<code>b64=false</code>), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied <code>detached_payload</code>. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. <em>Reported by <a href="https://github.com/thesmartshadow"><code>@thesmartshadow</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4"><code>GHSA-993g-76c3-p5m4</code></a> — <code>PyJWKClient</code> accepts non-HTTP(S) URIs.</strong> <code>PyJWKClient.fetch_data</code> passed its URI to <code>urllib.request.urlopen</code>, which by default also handles <code>file://</code>, <code>ftp://</code>, and <code>data:</code> schemes. An application that fed an attacker-influenced URI into <code>PyJWKClient</code> could be coerced into reading local files or reaching other unintended schemes. <code>PyJWKClient</code> now rejects any URI whose scheme isn't <code>http</code> or <code>https</code>. <em>Reported by <a href="https://github.com/KEIJOT"><code>@KEIJOT</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8"><code>GHSA-fhv5-28vv-h8m8</code></a> — <code>PyJWKClient</code> cache wiped on fetch error.</strong> A <code>finally</code>-block <code>put(jwk_set=None)</code> cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. <em>Reported by <a href="https://github.com/eddieran"><code>@eddieran</code></a>.</em></p> </li> </ul> <h2>Fixed</h2> <ul> <li>Reject empty HMAC keys outright in <code>HMACAlgorithm.prepare_key</code> with <code>InvalidKeyError</code> instead of accepting them with only a warning. Defends against the <code>os.getenv("JWT_SECRET", "")</code> footgun. <em>Thanks to <a href="https://github.com/SnailSploit"><code>@SnailSploit</code></a> and <a href="https://github.com/spartan8806"><code>@spartan8806</code></a> for the reports.</em></li> <li>Forward per-call <code>options</code> (including <code>enforce_minimum_key_length</code>) from <code>PyJWT.decode</code> through to <code>PyJWS._verify_signature</code>. The option was previously silently dropped between the two layers, so it only took effect when set on the <code>PyJWT</code> instance. <em>Thanks to <a href="https://github.com/WLUB"><code>@WLUB</code></a> for the report.</em></li> <li><strong>RFC 7797 §3 compliance for <code>b64=false</code>:</strong> the encoder now auto-adds <code>"b64"</code> to <code>crit</code>, and the decoder rejects tokens that set <code>b64=false</code> without listing it in <code>crit</code>. <em>Thanks to <a href="https://github.com/MachineLearning-Nerd"><code>@MachineLearning-Nerd</code></a> for the report.</em></li> </ul> <h2>Changed</h2> <ul> <li>Migrate the <code>dev</code>, <code>docs</code>, and <code>tests</code> package extras to dependency groups, by <a href="https://github.com/kurtmckee"><code>@kurtmckee</code></a> in <a href="https://redirect.github.com/jpadilla/pyjwt/pull/1152">#1152</a>.</li> </ul> <h2>Upgrade notes</h2> <p>Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:</p> <ul> <li><strong>Empty HMAC keys now raise.</strong> If your app passed <code>""</code> or <code>b""</code> as a secret (often via a missing env var, e.g. <code>os.getenv("JWT_SECRET", "")</code>), <code>encode</code>/<code>decode</code> will now raise <code>InvalidKeyError</code>. This is the intended behavior — fix the configuration.</li> <li><strong><code>PyJWK</code> decoding now requires the token's <code>alg</code> to match the JWK's algorithm.</strong> Previously a mismatch was silently honored if the header <code>alg</code> appeared in the allow-list. Tokens that relied on this mismatch will now fail with <code>InvalidAlgorithmError</code>.</li> <li><strong><code>PyJWKClient</code> now rejects non-HTTP(S) URIs at construction time.</strong> Tests or dev environments that fetched JWKS from <code>file://</code> URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct <code>PyJWKSet.from_dict(...)</code> directly).</li> <li><strong><code>b64=false</code> tokens are now strictly RFC 7515 / 7797 compliant.</strong> Tokens with a non-empty compact-form payload segment, or that omit <code>"b64"</code> from <code>crit</code>, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.</li> <li><strong><code>enforce_minimum_key_length</code> set per-call now takes effect.</strong> Callers who passed <code>options={"enforce_minimum_key_length": True}</code> to <code>jwt.decode()</code> previously got no enforcement; they will now get <code>InvalidKeyError</code> on undersized keys, as documented.</li> </ul> <p><strong>Full changelog:</strong> <a href="https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0">https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0</a></p> <h2>2.12.1</h2> <h2>What's Changed</h2> <ul> <li>Add typing_extensions dependency for Python < 3.11 by <a href="https://github.com/jpadilla"><code>@jpadilla</code></a> in <a href="https://redirect.github.com/jpadilla/pyjwt/pull/1151">jpadilla/pyjwt#1151</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1">https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1</a></p> <h2>2.12.0</h2> <h2>Security</h2> <ul> <li>Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by <a href="https://github.com/dmbs335"><code>@dmbs335</code></a> in <a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f">GHSA-752w-5fwx-jx9f</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0></code>__</h2> <p>Security</p> <pre><code> - Reject JWK JSON documents passed as raw HMAC secrets in ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that the existing PEM/SSH guard did not cover. Reported by @aradona91 in `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__. - Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during verification so the caller's ``algorithms=[...]`` allow-list cannot be bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__. - Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker- influenced URIs cannot read local files or reach unintended schemes via urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__. - Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``. The previous ``finally``-block ``put(None)`` pattern cleared the cache on any transient outage, turning one bad JWKS request into application- wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__. - Skip the unconditional base64 decode of the compact-form payload segment when ``b64=false`` is set in the protected header, and require that segment to be empty (RFC 7515 Appendix F detached form). Closes an unauthenticated DoS amplifier. Reported by @thesmartshadow in `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__. <p>Fixed</p> <pre><code> - Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with ``InvalidKeyError`` instead of accepting them with only a warning. Thanks to @SnailSploit and @spartan8806 for independently flagging the footgun. - Forward per-call ``options`` (including ``enforce_minimum_key_length``) from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the option actually takes effect when set at the call site rather than only on the ``PyJWT`` instance. Thanks to @WLUB for the report. - RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds ``&quot;b64&quot;`` to the ``crit`` header parameter, and the decoder rejects tokens that set ``b64=false`` without listing it in ``crit``. Thanks to @MachineLearning-Nerd for the report. Changed </code></pre> <ul> <li>Migrate the <code>dev</code>, <code>docs</code>, and <code>tests</code> package extras to dependency groups by <a href="https://github.com/kurtmckee"><code>@kurtmckee</code></a> in <code>[#1152](https://github.com/jpadilla/pyjwt/issues/1152) &lt;https://github.com/jpadilla/pyjwt/pull/1152&gt;</code>__</li> </ul> <p><code>v2.12.1 &lt;https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1&gt;</code>__ </tr></table> </code></pre></p> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jpadilla/pyjwt/commit/7144e4534c34810f4525dc4578a32addd8212cff"><code>7144e45</code></a> Apply ruff format</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/d2f4bec4963897c0ef96ef64a875894f2c8542ab"><code>d2f4bec</code></a> Restore <code>cast()</code> calls with cross-version <code>type: ignore</code> for <code>prepare_key</code></li> <li><a href="https://github.com/jpadilla/pyjwt/commit/22f478cebddd8294259c30f037ecb92b0b348774"><code>22f478c</code></a> Remove redundant casts in <code>RSAAlgorithm.prepare_key</code> and `ECAlgorithm.prepare...</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81"><code>95791b1</code></a> Bundle security fixes and hardening into 2.13.0</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/dcc27a9d3182a2349c30b160758785c6ce7a6508"><code>dcc27a9</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1155">#1155</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/9d08a9a1896845ed8eaf88e6f6ac61e5800c3e7a"><code>9d08a9a</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1146">#1146</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/b87c10014d4109f0214fea188d00faaaf8a80e64"><code>b87c100</code></a> Bump codecov/codecov-action from 5 to 6 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1154">#1154</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/40e3147eb5f790d8d041772e5fc00728a176c812"><code>40e3147</code></a> Migrate development extras to dependency groups (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1152">#1152</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/a4e1a3d1218b01c5806420b8f16d9308ac4adc30"><code>a4e1a3d</code></a> Add typing_extensions dependency for Python < 3.11 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1151">#1151</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/bd9700cca7f9258fadcc429c1034e508025931f2"><code>bd9700c</code></a> Use PyJWK algorithm when encoding without explicit algorithm (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1148">#1148</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.11.0...2.13.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]andcopilot-swe-agent[bot]
|
614db62500 |
Python: Bump tornado from 6.5.5 to 6.5.7 in /python (#14090)
Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.7. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst">tornado's changelog</a>.</em></p> <blockquote> <h1>Release notes</h1> <p>.. toctree:: :maxdepth: 2</p> <p>releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2 releases/v3.2.1</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4"><code>48fc2d4</code></a> Merge pull request <a href="https://redirect.github.com/tornadoweb/tornado/issues/3633">#3633</a> from bdarnell/curl-reset-65</li> <li><a href="https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841"><code>4ae1ddd</code></a> Release notes and version bump for 6.5.7</li> <li><a href="https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43"><code>3154caa</code></a> curl_httpclient: Reset the curl object before putting it on the freelist</li> <li><a href="https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2"><code>7d869c0</code></a> Merge pull request <a href="https://redirect.github.com/tornadoweb/tornado/issues/3631">#3631</a> from bdarnell/cve-links</li> <li><a href="https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3"><code>288241f</code></a> docs: Use the correct link syntax</li> <li><a href="https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6"><code>8da981c</code></a> docs: Add CVE links to 6.5.6 release notes</li> <li><a href="https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751"><code>aba2569</code></a> Merge pull request <a href="https://redirect.github.com/tornadoweb/tornado/issues/3626">#3626</a> from bdarnell/fixes-656</li> <li><a href="https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09"><code>a24b260</code></a> httpclient_test: Accept an additional error message variant</li> <li><a href="https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24"><code>a74240a</code></a> Release notes and version bump for 6.5.6.</li> <li><a href="https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5"><code>e8fc7ed</code></a> simple_httpclient: Strip auth headers on cross-origin redirects</li> <li>Additional commits viewable in <a href="https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> |
||
|
Evan Mattson
|
cd1b0205fa |
Python: Bump Python version to 1.43.1 for a release. (#14093)
### Motivation and Context Bump Python version to 1.43.1 for a release. <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Bump Python version to 1.43.1 for a release. <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [X] I didn't break anyone 😄 |
||
|
Roger Barreto
|
6ba60965bd |
Python: Reject encoded dot-segment paths in OpenAPI plugin (.NET and Python) (#14086)
## Motivation and Context Closes #14085. The .NET and Python OpenAPI plugins select operations using the raw OpenAPI path, but build the runtime request URL from a canonicalized path. Encoded dot-segments such as `/resources/%2e%2e/admin` pass an `OperationSelectionPredicate` path check, yet `System.Uri` (.NET) and `urljoin` (Python) collapse them to a different route at request time. The selected path and the actual request target can therefore diverge. ## Description - **.NET** (`RestApiOperation.ValidatePathSegments`): decodes each path segment until stable (handling double encoding like `%252e` and encoded separators `%2f`/`%5c`) before rejecting canonical `.` or `..` segments. - **Python** (`RestApiOperation.build_path`): adds equivalent decode-then-reject validation before the URL is built. Regression tests on both stacks cover literal and encoded dot-segments, mixed case, encoded slashes, and double encoding, plus negative tests confirming legitimate encoded characters still work. Test results: - .NET: 482/482 `Functions.UnitTests` OpenApi tests pass. - Python: 109/109 `openapi_plugin` unit tests pass. ## Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the SK Contribution Guidelines - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 |
||
|
SergeyMenshykhandCopilot
|
61331d834d |
Python: Add function_choice_behavior support to Azure AI and OpenAI Assistant agents (#14057)
### Description Adds `function_choice_behavior` parameter to Azure AI and OpenAI Assistant agents, aligning them with the existing Responses agent and Chat Completion agent APIs. ### Changes - Add `function_choice_behavior` parameter to `invoke`/`invoke_stream`/`get_response` on both `AzureAIAgent` and `OpenAIAssistantAgent` public APIs - Add `function_choice_behavior` parameter to internal `AzureAIAgentThreadActions` and `AssistantThreadActions` `invoke`/`invoke_stream` methods - Support `tools` parameter override for SDK-level tools (CodeInterpreter, FileSearch, etc.) - Filter kernel functions based on `FunctionChoiceBehavior` configuration - Validate that only `Auto` type with auto-invoke enabled is supported - Fix `_get_tools` in OpenAI path to use passed `kernel` parameter instead of `agent.kernel` - Add comprehensive unit tests for both thread actions and public agent APIs --------- Co-authored-by: Copilot <[email protected]> |
||
|
Evan Mattson
|
417d62f8b1 |
Python: Bump Python package version to 1.43.0 for a release (#14052)
### Motivation and Context Bump Python package version to 1.43.0 for a release <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Bump Python package version to 1.43.0 for a release <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
SergeyMenshykhandCopilot
|
644eb0a962 |
Python: [Breaking] Update OpenAPI document parsing options (#14009)
Update OpenAPI document parsing to gate file and HTTP ref resolution separately. ### Breaking change - `RESOLVE_FILES` is no longer enabled by default. Only internal JSON pointer references are resolved by default. - Users with multi-file OpenAPI specs must now pass `enable_file_ref_resolution=True` via `OpenAPIFunctionExecutionParameters`. - `enable_external_ref_resolution` has been renamed to `enable_http_ref_resolution`. --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
58f4a66858 |
Python: Improve function call invocation parameter consistency (#14014)
## Description This PR improves the consistency of how the function_behavior parameter is passed through internal invoke_function_call callsites. ### Changes - Thread function_behavior parameter through all internal invoke_function_call callsites for consistent parameter handling: - Realtime connector (_open_ai_realtime.py) - Responses agent (responses_agent_thread_actions.py) - Assistant agent (assistant_thread_actions.py) - Azure AI agent (agent_thread_actions.py) - Bedrock agent (bedrock_agent.py) - Add defensive logging in kernel.py when function_behavior is not provided - Add unit tests covering parameter handling scenarios ### Testing - All existing tests pass (678 passed, 0 failed) - 5 new tests added covering the updated parameter handling Co-authored-by: Copilot <[email protected]> |
||
|
Evan Mattson
|
2fb749e4bb |
Python: Bump Python pkg version to 1.42.0 for a release. (#14007)
### Motivation and Context Bump Python pkg version to 1.42.0 for a release. <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Bump Python pkg version to 1.42.0 for a release. <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [X] I didn't break anyone 😄 |
||
|
Evan MattsonandCopilot
|
a6c68af594 |
Python: Improvements for MCP (#14003)
### Motivation and Context Improvements for MCP tool calls by adding an optional sampling callback. <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Improvements for MCP tool calls by adding an optional sampling callback. <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
32abf99e29 |
Python: Harden HttpPlugin request validation (#13969)
Improve input validation and request handling in the Python HttpPlugin. ### Changes - Add explicit opt-in for unrestricted domain access - Tighten URL validation logic - Improve redirect handling when domain restrictions are configured - Add regression tests --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
a7cea9ab64 |
Python: Stop accessing private Azure SDK attributes in Azure AI Search connector (#13971)
### Motivation and Context CI fails with `AttributeError: 'SearchIndexClient' object has no attribute '_endpoint'` when `azure-search-documents` resolves to 12.0.0 (released 2026-04-01). The 12.0.0 release migrated from AutoRest to TypeSpec code generation, removing private attributes `_endpoint` and `_credential` from `SearchIndexClient`. CI uses `uv sync -U` which upgrades past the lockfile, pulling in 12.0.0 since `pyproject.toml` specifies `>= 11.6.0b4` with no upper bound. ### Description Stop reading `SearchIndexClient._endpoint` and `._credential`. Instead, store endpoint and credential as explicit fields on `AzureAISearchStore` and `AzureAISearchCollection`, and pass them directly when constructing `SearchClient`. **Changes:** - `_get_search_client()` accepts explicit `endpoint` + `credential` params instead of extracting from `SearchIndexClient` private attrs - `_resolve_credential()` new helper extracted from `_get_search_index_client()` for reuse - `AzureAISearchStore` / `AzureAISearchCollection` store `search_endpoint` and `search_credential` as fields, thread them through construction - Tests updated to assert on public fields instead of private SDK attributes ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] All unit tests pass with both `azure-search-documents==11.7.0b2` and `==12.0.0` - [x] No breaking changes to public API --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
3f0e2d58fa |
Python: Percent-encode OpenAPI path params & pin azure-search-documents (#13967)
Apply `urllib.parse.quote(safe='')` to path parameter values before substitution in `build_path()`, consistent with the .NET implementation which uses `HttpUtility.UrlEncode`. ### Changes - `rest_api_operation.py`: encode path parameter values per RFC 3986 - `test_sk_openapi.py`: add tests for encoded path parameters - `pyproject.toml` / `uv.lock`: pin `azure-search-documents >= 11.6.0b4, < 12.0.0` ### Pin azure-search-documents < 12.0.0 Version 12.0.0 removed the internal `_endpoint` attribute from `SearchIndexClient`, which breaks `AzureAISearchCollection` initialization at `azure_ai_search.py:158`. Pinning to `< 12.0.0` until the code is updated to use the new public API. ### Tests All existing and new `build_path` tests pass. --------- Co-authored-by: Copilot <[email protected]> |
||
|
dependabot[bot]
|
4e4b9456b8 |
Python: Update pydantic requirement from !=2.10.0,!=2.10.1,!=2.10.2,!=2.10.3,<2.13,>=2.0 to >=2.0,!=2.10.0,!=2.10.1,!=2.10.2,!=2.10.3,<2.14 in /python (#13864)
Updates the requirements on [pydantic](https://github.com/pydantic/pydantic) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic/releases">pydantic's releases</a>.</em></p> <blockquote> <h2>v2.13.0 2026-04-13</h2> <h2>v2.13.0 (2026-04-13)</h2> <p>The highlights of the v2.13 release are available in the <a href="https://pydantic.dev/articles/pydantic-v2-13-release">blog post</a>. Several minor changes (considered non-breaking changes according to our <a href="https://pydantic.dev/docs/validation/2.13/get-started/version-policy/#pydantic-v2">versioning policy</a>) are also included in this release. Make sure to look into them before upgrading.</p> <p>This release contains the updated <code>pydantic.v1</code> namespace, matching version 1.10.26 which includes support for Python 3.14.</p> <h3>What's Changed</h3> <p>See the beta releases for all changes sinces 2.12.</p> <h4>Packaging</h4> <ul> <li>Add zizmor for GitHub Actions workflow linting by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13039">#13039</a></li> <li>Update jiter to v0.14.0 to fix a segmentation fault on musl Linux by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13064">#13064</a></li> </ul> <h4>New Features</h4> <ul> <li>Allow default factories of private attributes to take validated model data by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13013">#13013</a></li> </ul> <h4>Changes</h4> <ul> <li>Warn when serializing fixed length tuples with too few items by <a href="https://github.com/arvindsaripalli"><code>@arvindsaripalli</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13016">#13016</a></li> </ul> <h4>Fixes</h4> <ul> <li>Change type of <code>Any</code> when synthesizing <code>_build_sources</code> for <code>BaseSettings.__init__()</code> signature in the mypy plugin by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13049">#13049</a></li> <li>Fix model equality when using runtime <code>extra</code> configuration by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13062">#13062</a></li> </ul> <h3>New Contributors</h3> <ul> <li><a href="https://github.com/arvindsaripalli"><code>@arvindsaripalli</code></a> made their first contribution in <a href="https://redirect.github.com/pydantic/pydantic/pull/13016">#13016</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/pydantic/compare/v2.12.0...v2.13.0">https://github.com/pydantic/pydantic/compare/v2.12.0...v2.13.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic/blob/main/HISTORY.md">pydantic's changelog</a>.</em></p> <blockquote> <h2>v2.13.0 (2026-04-13)</h2> <p><a href="https://github.com/pydantic/pydantic/releases/tag/v2.13.0">GitHub release</a></p> <p>The highlights of the v2.13 release are available in the <a href="https://pydantic.dev/articles/pydantic-v2-13-release">blog post</a>. Several minor changes (considered non-breaking changes according to our <a href="https://pydantic.dev/docs/validation/2.13/get-started/version-policy/#pydantic-v2">versioning policy</a>) are also included in this release. Make sure to look into them before upgrading.</p> <p>This release contains the updated <code>pydantic.v1</code> namespace, matching version 1.10.26 which includes support for Python 3.14.</p> <h3>What's Changed</h3> <p>See the beta releases for all changes sinces 2.12.</p> <h4>New Features</h4> <ul> <li>Allow default factories of private attributes to take validated model data by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13013">#13013</a></li> </ul> <h4>Changes</h4> <ul> <li>Warn when serializing fixed length tuples with too few items by <a href="https://github.com/arvindsaripalli"><code>@arvindsaripalli</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13016">#13016</a></li> </ul> <h4>Fixes</h4> <ul> <li>Change type of <code>Any</code> when synthesizing <code>_build_sources</code> for <code>BaseSettings.__init__()</code> signature in the mypy plugin by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13049">#13049</a></li> <li>Fix model equality when using runtime <code>extra</code> configuration by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13062">#13062</a></li> </ul> <h4>Packaging</h4> <ul> <li>Add zizmor for GitHub Actions workflow linting by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13039">#13039</a></li> <li>Update jiter to v0.14.0 to fix a segmentation fault on musl Linux by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13064">#13064</a></li> </ul> <h3>New Contributors</h3> <ul> <li><a href="https://github.com/arvindsaripalli"><code>@arvindsaripalli</code></a> made their first contribution in <a href="https://redirect.github.com/pydantic/pydantic/pull/13016">#13016</a></li> </ul> <h2>v2.13.0b3 (2026-03-31)</h2> <p><a href="https://github.com/pydantic/pydantic/releases/tag/v2.13.0b3">GitHub release</a></p> <h3>What's Changed</h3> <h4>New Features</h4> <ul> <li>Add <code>ascii_only</code> option to <code>StringConstraints</code> by <a href="https://github.com/ai-man-codes"><code>@ai-man-codes</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12907">#12907</a></li> <li>Support <code>exclude_if</code> in computed fields by <a href="https://github.com/andresliszt"><code>@andresliszt</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12748">#12748</a></li> <li>Push down constraints in unions involving <code>MISSING</code> sentinel by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12908">#12908</a></li> </ul> <h4>Changes</h4> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pydantic/pydantic/commit/46bf4fa648af3a1fbf4603a37f210e9d9c618357"><code>46bf4fa</code></a> Fix Pydantic release workflow (<a href="https://redirect.github.com/pydantic/pydantic/issues/13067">#13067</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/1b359edab09c623464d23c6fd2503ae5ff276d43"><code>1b359ed</code></a> Prepare release v2.13.0 (<a href="https://redirect.github.com/pydantic/pydantic/issues/13065">#13065</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/b1bf19445d8ac144a7a0e82674d2d87eebab6c18"><code>b1bf194</code></a> Fix model equality when using runtime <code>extra</code> configuration (<a href="https://redirect.github.com/pydantic/pydantic/issues/13062">#13062</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/17a35e371bdff348c0690651d324c91fc7c9ff9e"><code>17a35e3</code></a> Update jiter to v0.14.0 (<a href="https://redirect.github.com/pydantic/pydantic/issues/13064">#13064</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/feea402b23fa23774669908c4e08a61ba1e4238e"><code>feea402</code></a> Use <code>simulation</code> mode in Codspeed CI (<a href="https://redirect.github.com/pydantic/pydantic/issues/13063">#13063</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/671c9b0d4d3f9b2f1b95ca32ac85cb69e824e0bc"><code>671c9b0</code></a> Add basic benchmarks for model equality (<a href="https://redirect.github.com/pydantic/pydantic/issues/13061">#13061</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/d17d71e00a35f190b27321aa6f8f2a03139c00b8"><code>d17d71e</code></a> Bump cryptography from 46.0.6 to 46.0.7 (<a href="https://redirect.github.com/pydantic/pydantic/issues/13056">#13056</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/919d61ac419af5151b673a90b65c9a12631091cf"><code>919d61a</code></a> 👥 Update Pydantic People (<a href="https://redirect.github.com/pydantic/pydantic/issues/13059">#13059</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/e7cf5dcb939ea98511e669b647c0273667a1b08a"><code>e7cf5dc</code></a> Fix people workflow (<a href="https://redirect.github.com/pydantic/pydantic/issues/13047">#13047</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/2a806ad09b984fcc43568191aba5d965350995a0"><code>2a806ad</code></a> Add regression test for <code>MISSING</code> sentinel serialization with subclasses (<a href="https://redirect.github.com/pydantic/pydantic/issues/13">#13</a>...</li> <li>Additional commits viewable in <a href="https://github.com/pydantic/pydantic/compare/v2.0...v2.13.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
6cc918e87f |
Update google-genai requirement from ~=1.51.0 to >=1.51,<1.75 in /python (#13865)
Updates the requirements on [google-genai](https://github.com/googleapis/python-genai) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/python-genai/releases">google-genai's releases</a>.</em></p> <blockquote> <h2>v1.74.0</h2> <h2><a href="https://github.com/googleapis/python-genai/compare/v1.73.1...v1.74.0">1.74.0</a> (2026-04-29)</h2> <h3>Features</h3> <ul> <li>[Interactions] Add FileCitation.{custom_metadata,media_id,page_number} (<a href="https://github.com/googleapis/python-genai/commit/aed41ecf4940f63446fc3e22744663be4d1057a6">aed41ec</a>)</li> <li>Add <code>output_info</code> to <code>BatchJob</code> (<a href="https://github.com/googleapis/python-genai/commit/7b77ab850283a2c55cb711084e8de6b6da5e589c">7b77ab8</a>)</li> <li>Add gemini-3.1-flash-tts-preview model to options (<a href="https://github.com/googleapis/python-genai/commit/8bdc1c353d987a5a18282fd2265950257891d308">8bdc1c3</a>)</li> <li>Add ImageResizeMode for GenerateVideos (<a href="https://github.com/googleapis/python-genai/commit/317d2af040adc7639c4464971d2a5ffa5e381402">317d2af</a>)</li> <li>Add new Gemini Deep Research agent models (<a href="https://github.com/googleapis/python-genai/commit/16fffbd3504e9c83c605410dc75914bf3bcaeedb">16fffbd</a>)</li> <li>Add one_of support to JSONSchema for Agent Platform (<a href="https://github.com/googleapis/python-genai/commit/8c00c524488250f25f497e47b495dcedb362da86">8c00c52</a>)</li> <li>Add Vertex Dataset input and output options for batch jobs (<a href="https://github.com/googleapis/python-genai/commit/d880f92a0631868d6cf86e30aa219a18305ad1a0">d880f92</a>)</li> <li><strong>interaction-api:</strong> Add grounding tool usage breakdown to Interaction Usage. (<a href="https://github.com/googleapis/python-genai/commit/b24fb5a1758499e3979cdcadfa734bfa7dd72c94">b24fb5a</a>)</li> <li>Introduce <code>enterprise</code> to Client constructor and <code>GOOGLE_GENAI_USE_ENTERPRISE</code> (<a href="https://github.com/googleapis/python-genai/commit/693fd9af1054fde006f76ea820b0c9066577b243">693fd9a</a>)</li> <li>Replace the more ambiguous rate field with sample_rate. (<a href="https://github.com/googleapis/python-genai/commit/88d9b4ad772ce75f21d44174f4679e994fcfca48">88d9b4a</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Catch google-auth wrapped errors (<a href="https://github.com/googleapis/python-genai/commit/48ac850fa06de2288e4d736f2f7349909c2a0727">48ac850</a>)</li> <li>Removing Python 3.9 support due to EOL (<a href="https://github.com/googleapis/python-genai/commit/8bc2b1028da7b94ed0baa31f89a1bf007aaa0bf8">8bc2b10</a>)</li> <li><strong>retry:</strong> Retry on httpx.TimeoutException with HttpRetryOptions (<a href="https://redirect.github.com/googleapis/python-genai/issues/2345">#2345</a>) (<a href="https://github.com/googleapis/python-genai/commit/0598bab551f40d852dcd4b4575be8dacec42f83e">0598bab</a>)</li> <li>Streaming method doesn't handle multi-line SSE (<a href="https://github.com/googleapis/python-genai/commit/f8a2e7ea8c39800aa0a6c50585de49c2c0d5f247">f8a2e7e</a>)</li> <li>Typing in <code>AsyncClient.__aexit__</code>, <code>__exit__</code>. (<a href="https://github.com/googleapis/python-genai/commit/a74dc6564e3409f9c45a1ec8456ed4386c3711c0">a74dc65</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Add instruction for custom endpoint (<a href="https://github.com/googleapis/python-genai/commit/dd79904ed3a51fb53c43d4b01082556baf579759">dd79904</a>)</li> <li>Fix broken link for rate limits (<a href="https://github.com/googleapis/python-genai/commit/d22ea99dd4318c3bd47bfd6cb571bf9db3316922">d22ea99</a>)</li> <li>Regenerate docs for 1.73.1 (<a href="https://github.com/googleapis/python-genai/commit/2fb714b3fefa3a8972da57ef0675116b67e4808e">2fb714b</a>)</li> <li>Remove duplicate line in genai client docstring. (<a href="https://github.com/googleapis/python-genai/commit/b1c6026033fc753d1fcd474d8f63f254a876741c">b1c6026</a>)</li> <li>Replace Vertex AI with Gemini Enterprise Agent Platform (<a href="https://github.com/googleapis/python-genai/commit/7c1ecd586032a0546268ede3f115b2d25032ce12">7c1ecd5</a>)</li> <li>Update doc string to replace <code>Vertex AI</code> with <code>Gemini Enterprise Agent Platform</code>, update method error message to replace <code>Vertex AI</code> with <code>Gemini Enterprise Agent Platform (previously known as Vertex AI)</code>, update converter error message to replace <code>Vertex AI</code> with <code>Gemini Enterprise Agent Platform</code> (<a href="https://github.com/googleapis/python-genai/commit/413f0f9f1b5ff8bab9fd3675e9c450a4ddd29755">413f0f9</a>)</li> <li>Update Gemini Enterprise Agent Platform home page url (<a href="https://github.com/googleapis/python-genai/commit/b02cb95459375300c4e2acdef11a8ff0e8d5def6">b02cb95</a>)</li> <li>Update README.md with correct Pydantic link (<a href="https://github.com/googleapis/python-genai/commit/fa97cc6cf5bc955c1ff81da4e780fe0211648959">fa97cc6</a>)</li> <li>Update README.md with correct Pydantic link (<a href="https://github.com/googleapis/python-genai/commit/fa97cc6cf5bc955c1ff81da4e780fe0211648959">fa97cc6</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/python-genai/blob/main/CHANGELOG.md">google-genai's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/python-genai/compare/v1.73.1...v1.74.0">1.74.0</a> (2026-04-29)</h2> <h3>Features</h3> <ul> <li>[Interactions] Add FileCitation.{custom_metadata,media_id,page_number} (<a href="https://github.com/googleapis/python-genai/commit/aed41ecf4940f63446fc3e22744663be4d1057a6">aed41ec</a>)</li> <li>Add <code>output_info</code> to <code>BatchJob</code> (<a href="https://github.com/googleapis/python-genai/commit/7b77ab850283a2c55cb711084e8de6b6da5e589c">7b77ab8</a>)</li> <li>Add gemini-3.1-flash-tts-preview model to options (<a href="https://github.com/googleapis/python-genai/commit/8bdc1c353d987a5a18282fd2265950257891d308">8bdc1c3</a>)</li> <li>Add ImageResizeMode for GenerateVideos (<a href="https://github.com/googleapis/python-genai/commit/317d2af040adc7639c4464971d2a5ffa5e381402">317d2af</a>)</li> <li>Add new Gemini Deep Research agent models (<a href="https://github.com/googleapis/python-genai/commit/16fffbd3504e9c83c605410dc75914bf3bcaeedb">16fffbd</a>)</li> <li>Add one_of support to JSONSchema for Agent Platform (<a href="https://github.com/googleapis/python-genai/commit/8c00c524488250f25f497e47b495dcedb362da86">8c00c52</a>)</li> <li>Add Vertex Dataset input and output options for batch jobs (<a href="https://github.com/googleapis/python-genai/commit/d880f92a0631868d6cf86e30aa219a18305ad1a0">d880f92</a>)</li> <li><strong>interaction-api:</strong> Add grounding tool usage breakdown to Interaction Usage. (<a href="https://github.com/googleapis/python-genai/commit/b24fb5a1758499e3979cdcadfa734bfa7dd72c94">b24fb5a</a>)</li> <li>Introduce <code>enterprise</code> to Client constructor and <code>GOOGLE_GENAI_USE_ENTERPRISE</code> (<a href="https://github.com/googleapis/python-genai/commit/693fd9af1054fde006f76ea820b0c9066577b243">693fd9a</a>)</li> <li>Replace the more ambiguous rate field with sample_rate. (<a href="https://github.com/googleapis/python-genai/commit/88d9b4ad772ce75f21d44174f4679e994fcfca48">88d9b4a</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Catch google-auth wrapped errors (<a href="https://github.com/googleapis/python-genai/commit/48ac850fa06de2288e4d736f2f7349909c2a0727">48ac850</a>)</li> <li>Removing Python 3.9 support due to EOL (<a href="https://github.com/googleapis/python-genai/commit/8bc2b1028da7b94ed0baa31f89a1bf007aaa0bf8">8bc2b10</a>)</li> <li><strong>retry:</strong> Retry on httpx.TimeoutException with HttpRetryOptions (<a href="https://redirect.github.com/googleapis/python-genai/issues/2345">#2345</a>) (<a href="https://github.com/googleapis/python-genai/commit/0598bab551f40d852dcd4b4575be8dacec42f83e">0598bab</a>)</li> <li>Streaming method doesn't handle multi-line SSE (<a href="https://github.com/googleapis/python-genai/commit/f8a2e7ea8c39800aa0a6c50585de49c2c0d5f247">f8a2e7e</a>)</li> <li>Typing in <code>AsyncClient.__aexit__</code>, <code>__exit__</code>. (<a href="https://github.com/googleapis/python-genai/commit/a74dc6564e3409f9c45a1ec8456ed4386c3711c0">a74dc65</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Add instruction for custom endpoint (<a href="https://github.com/googleapis/python-genai/commit/dd79904ed3a51fb53c43d4b01082556baf579759">dd79904</a>)</li> <li>Fix broken link for rate limits (<a href="https://github.com/googleapis/python-genai/commit/d22ea99dd4318c3bd47bfd6cb571bf9db3316922">d22ea99</a>)</li> <li>Regenerate docs for 1.73.1 (<a href="https://github.com/googleapis/python-genai/commit/2fb714b3fefa3a8972da57ef0675116b67e4808e">2fb714b</a>)</li> <li>Remove duplicate line in genai client docstring. (<a href="https://github.com/googleapis/python-genai/commit/b1c6026033fc753d1fcd474d8f63f254a876741c">b1c6026</a>)</li> <li>Replace Vertex AI with Gemini Enterprise Agent Platform (<a href="https://github.com/googleapis/python-genai/commit/7c1ecd586032a0546268ede3f115b2d25032ce12">7c1ecd5</a>)</li> <li>Update doc string to replace <code>Vertex AI</code> with <code>Gemini Enterprise Agent Platform</code>, update method error message to replace <code>Vertex AI</code> with <code>Gemini Enterprise Agent Platform (previously known as Vertex AI)</code>, update converter error message to replace <code>Vertex AI</code> with <code>Gemini Enterprise Agent Platform</code> (<a href="https://github.com/googleapis/python-genai/commit/413f0f9f1b5ff8bab9fd3675e9c450a4ddd29755">413f0f9</a>)</li> <li>Update Gemini Enterprise Agent Platform home page url (<a href="https://github.com/googleapis/python-genai/commit/b02cb95459375300c4e2acdef11a8ff0e8d5def6">b02cb95</a>)</li> <li>Update README.md with correct Pydantic link (<a href="https://github.com/googleapis/python-genai/commit/fa97cc6cf5bc955c1ff81da4e780fe0211648959">fa97cc6</a>)</li> <li>Update README.md with correct Pydantic link (<a href="https://github.com/googleapis/python-genai/commit/fa97cc6cf5bc955c1ff81da4e780fe0211648959">fa97cc6</a>)</li> </ul> <h2><a href="https://github.com/googleapis/python-genai/compare/v1.73.0...v1.73.1">1.73.1</a> (2026-04-14)</h2> <h3>Bug Fixes</h3> <ul> <li>Refactor Webhook types in GenAI SDKs for easier useage (<a href="https://github.com/googleapis/python-genai/commit/3f36ca11b30904c8f82dd3e7e3b59eff3bde6a3b">3f36ca1</a>)</li> <li>Rename <code>webhooks.retrieve</code> to <code>webhooks.get</code>. (<a href="https://github.com/googleapis/python-genai/commit/649f4b06d7bd78a23dd77b06713c6ca5c65321f9">649f4b0</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Update python docs for 1.73.0 (<a href="https://github.com/googleapis/python-genai/commit/acd3767bff513524172ddd7726b147d01c245f1c">acd3767</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/python-genai/commit/860c041810c6b37638ea23370d39c80364b5c99a"><code>860c041</code></a> chore(main): release 1.74.0 (<a href="https://redirect.github.com/googleapis/python-genai/issues/2285">#2285</a>)</li> <li><a href="https://github.com/googleapis/python-genai/commit/abcaa0d25da63a58c9ef96dac3b692c8396e5f42"><code>abcaa0d</code></a> chore: Fix usage examples of LocalTokenizer.</li> <li><a href="https://github.com/googleapis/python-genai/commit/b7e877129ee75e1fe824e2dc97e951a5ba5690cb"><code>b7e8771</code></a> chore: Add page number</li> <li><a href="https://github.com/googleapis/python-genai/commit/841301ee3901b34899a583939dfc28462d3db9d9"><code>841301e</code></a> chore: Adjust Webhook update to better reflect modifiable fields</li> <li><a href="https://github.com/googleapis/python-genai/commit/b24fb5a1758499e3979cdcadfa734bfa7dd72c94"><code>b24fb5a</code></a> feat(interaction-api): Add grounding tool usage breakdown to Interaction Usage.</li> <li><a href="https://github.com/googleapis/python-genai/commit/b1c6026033fc753d1fcd474d8f63f254a876741c"><code>b1c6026</code></a> docs: Remove duplicate line in genai client docstring.</li> <li><a href="https://github.com/googleapis/python-genai/commit/0598bab551f40d852dcd4b4575be8dacec42f83e"><code>0598bab</code></a> fix(retry): retry on httpx.TimeoutException with HttpRetryOptions (<a href="https://redirect.github.com/googleapis/python-genai/issues/2345">#2345</a>)</li> <li><a href="https://github.com/googleapis/python-genai/commit/f8a2e7ea8c39800aa0a6c50585de49c2c0d5f247"><code>f8a2e7e</code></a> fix: Streaming method doesn't handle multi-line SSE</li> <li><a href="https://github.com/googleapis/python-genai/commit/8bc2b1028da7b94ed0baa31f89a1bf007aaa0bf8"><code>8bc2b10</code></a> fix: Removing Python 3.9 support due to EOL</li> <li><a href="https://github.com/googleapis/python-genai/commit/ab5e3283bed8a3c1502c9486f68848a1d5e821a0"><code>ab5e328</code></a> chore: internal change</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/python-genai/compare/v1.51.0...v1.74.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
479f9443ee |
Python: Bump google-cloud-aiplatform from 1.114.0 to 1.133.0 in /python (#13577)
Bumps [google-cloud-aiplatform](https://github.com/googleapis/python-aiplatform) from 1.114.0 to 1.133.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/python-aiplatform/releases">google-cloud-aiplatform's releases</a>.</em></p> <blockquote> <h2>v1.133.0</h2> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.132.0...v1.133.0">1.133.0</a> (2026-01-08)</h2> <h3>Features</h3> <ul> <li>Deprecate tuning public preview SDK in favor of tuning SDK (<a href="https://github.com/googleapis/python-aiplatform/commit/35d362ce8f6c50498f781857e0d8cabd327284be">35d362c</a>)</li> <li>GenAI SDK client - Enabling Few-shot Prompt Optimization by passing either "OPTIMIZATION_TARGET_FEW_SHOT_RUBRICS" or "OPTIMIZATION_TARGET_FEW_SHOT_TARGET_RESPONSE" to the <code>optimize_prompt</code> method (<a href="https://github.com/googleapis/python-aiplatform/commit/715cc5b71b996eecde2d97bad71a617274739dcc">715cc5b</a>)</li> <li>GenAI SDK client(memory): Add enable_third_person_memories (<a href="https://github.com/googleapis/python-aiplatform/commit/65717fa0c3d9b8c3105638cf9c75ee415f36b6e0">65717fa</a>)</li> <li>Support Developer Connect in AE (<a href="https://github.com/googleapis/python-aiplatform/commit/04f1771e16f54a0627ecac1266764ca77f833694">04f1771</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Add None check for agent_info in evals.py (<a href="https://github.com/googleapis/python-aiplatform/commit/c8c0f0f7eb67696c2e91902af7e6dca20cea2040">c8c0f0f</a>)</li> <li>GenAI client(evals) - Fix TypeError in _build_generate_content_config (<a href="https://github.com/googleapis/python-aiplatform/commit/be2eaaa30dbf13a86f6856771eeacd2a51a97806">be2eaaa</a>)</li> <li>Make project_number to project_id mapping fail-open. (<a href="https://github.com/googleapis/python-aiplatform/commit/f1c8458dd5e4641cb03ff175f0837b6d6017c131">f1c8458</a>)</li> <li>Replace asyncio.run with create_task in ADK async thread mains. (<a href="https://github.com/googleapis/python-aiplatform/commit/83f4076706d808dcc0e1784219856846540e10da">83f4076</a>)</li> <li>Replace asyncio.run with create_task in ADK async thread mains. (<a href="https://github.com/googleapis/python-aiplatform/commit/8c876ef069d0fe6942790ede41e203196cd4a390">8c876ef</a>)</li> <li>Require uri or staging bucket configuration for saving model to Vertex Experiment. (<a href="https://github.com/googleapis/python-aiplatform/commit/5448f065fa30d77c2ee0868249ec0bea6a93a4c0">5448f06</a>)</li> <li>Return embedding metadata if available (<a href="https://github.com/googleapis/python-aiplatform/commit/d9c6eb199b6ccc1fae417463e1b374574f2ae2f8">d9c6eb1</a>)</li> <li>Update <code>examples_dataframe</code> type to <code>PandasDataFrame</code> in Prompt Optimizer. (<a href="https://github.com/googleapis/python-aiplatform/commit/a2564cc3ea5c4860ee732f14cea9db2c10b52420">a2564cc</a>)</li> </ul> <h2>v1.132.0</h2> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.131.0...v1.132.0">1.132.0</a> (2025-12-17)</h2> <h3>Features</h3> <ul> <li>Add Lustre support to the Vertex Training Custom Job API (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>A comment for field <code>restart_job_on_worker_restart</code> in message <code>.google.cloud.aiplatform.v1beta1.Scheduling</code> is changed (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> <li>A comment for field <code>timeout</code> in message <code>.google.cloud.aiplatform.v1beta1.Scheduling</code> is changed (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> </ul> <h2>v1.131.0</h2> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.130.0...v1.131.0">1.131.0</a> (2025-12-16)</h2> <h3>Features</h3> <ul> <li>Allow list of events to be passed to AdkApp.async_stream_query (<a href="https://github.com/googleapis/python-aiplatform/commit/dd8840a5012b2762f8b8971b6cea4302ac5c648d">dd8840a</a>)</li> <li>GenAI Client(evals) - Support CustomCodeExecution metric in Vertex Gen AI Eval Service (<a href="https://github.com/googleapis/python-aiplatform/commit/4114728750b5b12f991a18df87c1f1a570d1b29d">4114728</a>)</li> <li>Updates the ADK template to direct structured JSON logs to standard output. (<a href="https://github.com/googleapis/python-aiplatform/commit/a65ec297c5b8d99e4d2dfb49473c189197198f97">a65ec29</a>)</li> </ul> <h3>Bug Fixes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/python-aiplatform/blob/main/CHANGELOG.md">google-cloud-aiplatform's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.132.0...v1.133.0">1.133.0</a> (2026-01-08)</h2> <h3>Features</h3> <ul> <li>Deprecate tuning public preview SDK in favor of tuning SDK (<a href="https://github.com/googleapis/python-aiplatform/commit/35d362ce8f6c50498f781857e0d8cabd327284be">35d362c</a>)</li> <li>GenAI SDK client - Enabling Few-shot Prompt Optimization by passing either "OPTIMIZATION_TARGET_FEW_SHOT_RUBRICS" or "OPTIMIZATION_TARGET_FEW_SHOT_TARGET_RESPONSE" to the <code>optimize_prompt</code> method (<a href="https://github.com/googleapis/python-aiplatform/commit/715cc5b71b996eecde2d97bad71a617274739dcc">715cc5b</a>)</li> <li>GenAI SDK client(memory): Add enable_third_person_memories (<a href="https://github.com/googleapis/python-aiplatform/commit/65717fa0c3d9b8c3105638cf9c75ee415f36b6e0">65717fa</a>)</li> <li>Support Developer Connect in AE (<a href="https://github.com/googleapis/python-aiplatform/commit/04f1771e16f54a0627ecac1266764ca77f833694">04f1771</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Add None check for agent_info in evals.py (<a href="https://github.com/googleapis/python-aiplatform/commit/c8c0f0f7eb67696c2e91902af7e6dca20cea2040">c8c0f0f</a>)</li> <li>GenAI client(evals) - Fix TypeError in _build_generate_content_config (<a href="https://github.com/googleapis/python-aiplatform/commit/be2eaaa30dbf13a86f6856771eeacd2a51a97806">be2eaaa</a>)</li> <li>Make project_number to project_id mapping fail-open. (<a href="https://github.com/googleapis/python-aiplatform/commit/f1c8458dd5e4641cb03ff175f0837b6d6017c131">f1c8458</a>)</li> <li>Replace asyncio.run with create_task in ADK async thread mains. (<a href="https://github.com/googleapis/python-aiplatform/commit/83f4076706d808dcc0e1784219856846540e10da">83f4076</a>)</li> <li>Replace asyncio.run with create_task in ADK async thread mains. (<a href="https://github.com/googleapis/python-aiplatform/commit/8c876ef069d0fe6942790ede41e203196cd4a390">8c876ef</a>)</li> <li>Require uri or staging bucket configuration for saving model to Vertex Experiment. (<a href="https://github.com/googleapis/python-aiplatform/commit/5448f065fa30d77c2ee0868249ec0bea6a93a4c0">5448f06</a>)</li> <li>Return embedding metadata if available (<a href="https://github.com/googleapis/python-aiplatform/commit/d9c6eb199b6ccc1fae417463e1b374574f2ae2f8">d9c6eb1</a>)</li> <li>Update <code>examples_dataframe</code> type to <code>PandasDataFrame</code> in Prompt Optimizer. (<a href="https://github.com/googleapis/python-aiplatform/commit/a2564cc3ea5c4860ee732f14cea9db2c10b52420">a2564cc</a>)</li> </ul> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.131.0...v1.132.0">1.132.0</a> (2025-12-17)</h2> <h3>Features</h3> <ul> <li>Add Lustre support to the Vertex Training Custom Job API (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> <li>Add Lustre support to the Vertex Training Custom Job API (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>A comment for field <code>restart_job_on_worker_restart</code> in message <code>.google.cloud.aiplatform.v1beta1.Scheduling</code> is changed (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> <li>A comment for field <code>timeout</code> in message <code>.google.cloud.aiplatform.v1beta1.Scheduling</code> is changed (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> </ul> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.130.0...v1.131.0">1.131.0</a> (2025-12-16)</h2> <h3>Features</h3> <ul> <li>Allow list of events to be passed to AdkApp.async_stream_query (<a href="https://github.com/googleapis/python-aiplatform/commit/dd8840a5012b2762f8b8971b6cea4302ac5c648d">dd8840a</a>)</li> <li>GenAI Client(evals) - Support CustomCodeExecution metric in Vertex Gen AI Eval Service (<a href="https://github.com/googleapis/python-aiplatform/commit/4114728750b5b12f991a18df87c1f1a570d1b29d">4114728</a>)</li> <li>Updates the ADK template to direct structured JSON logs to standard output. (<a href="https://github.com/googleapis/python-aiplatform/commit/a65ec297c5b8d99e4d2dfb49473c189197198f97">a65ec29</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Fix RagManagedVertexVectorSearch when using backend_config (<a href="https://github.com/googleapis/python-aiplatform/commit/df0976ed3195dc8313f4728bc5ecb29dda55d467">df0976e</a>)</li> <li>GenAI Client(evals) - patch for vulnerability in visualization (<a href="https://github.com/googleapis/python-aiplatform/commit/8a00d43dbd24e95dbab6ea32c63ce0a5a1849480">8a00d43</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/python-aiplatform/commit/78f2bdd08bae0696923e61ab73080b5846c67ae0"><code>78f2bdd</code></a> chore(main): release 1.133.0 (<a href="https://redirect.github.com/googleapis/python-aiplatform/issues/6211">#6211</a>)</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/c8c0f0f7eb67696c2e91902af7e6dca20cea2040"><code>c8c0f0f</code></a> fix: Add None check for agent_info in evals.py</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/9952b970b73cfe38e68c48b3699ee4e1df0264df"><code>9952b97</code></a> chore: rollback</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/83f4076706d808dcc0e1784219856846540e10da"><code>83f4076</code></a> fix: Replace asyncio.run with create_task in ADK async thread mains.</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/937d5af6b9bdbbe3b50181745c99550f124ad8b4"><code>937d5af</code></a> Copybara import of the project:</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/aaaf902be02747cd2281196aad6278df0fd11f7e"><code>aaaf902</code></a> chore: bump google-auth lower bound to 2.47.0 in GenAI and Vertex SDKs</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/8c876ef069d0fe6942790ede41e203196cd4a390"><code>8c876ef</code></a> fix: Replace asyncio.run with create_task in ADK async thread mains.</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/5448f065fa30d77c2ee0868249ec0bea6a93a4c0"><code>5448f06</code></a> fix: Require uri or staging bucket configuration for saving model to Vertex E...</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/65717fa0c3d9b8c3105638cf9c75ee415f36b6e0"><code>65717fa</code></a> feat: GenAI SDK client(memory): Add enable_third_person_memories</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/be2eaaa30dbf13a86f6856771eeacd2a51a97806"><code>be2eaaa</code></a> fix: GenAI client(evals) - Fix TypeError in _build_generate_content_config</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/python-aiplatform/compare/v1.114.0...v1.133.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
ff3a1c6c6e |
Python: Update boto3 requirement from <1.41.0,>=1.36.4 to >=1.36.4,<1.43.0 in /python (#13867)
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/boto/boto3/commit/54a9dc1891d5e38110e5f77fc45fbc7e2e112bfe"><code>54a9dc1</code></a> Merge branch 'release-1.42.89'</li> <li><a href="https://github.com/boto/boto3/commit/730d84cd5a2396ff9bfe8b59b7ee7339aa6bd8c5"><code>730d84c</code></a> Bumping version to 1.42.89</li> <li><a href="https://github.com/boto/boto3/commit/6b657684e661904d387c867ccd8aea796f7092ff"><code>6b65768</code></a> Add changelog entries from botocore</li> <li><a href="https://github.com/boto/boto3/commit/f92a06cca537b03c6cbc71b2ab004674298053dd"><code>f92a06c</code></a> Merge branch 'release-1.42.88'</li> <li><a href="https://github.com/boto/boto3/commit/5da0f6a8b8ed0117747b2f8a4f2ffa2a8e3a5eb6"><code>5da0f6a</code></a> Merge branch 'release-1.42.88' into develop</li> <li><a href="https://github.com/boto/boto3/commit/9bdec29dd7a50a0412772bae77580bb3be674295"><code>9bdec29</code></a> Bumping version to 1.42.88</li> <li><a href="https://github.com/boto/boto3/commit/d880788fea57399dd5e9e2be08691a2b9ec26502"><code>d880788</code></a> Add changelog entries from botocore</li> <li><a href="https://github.com/boto/boto3/commit/39a412231d29b10761a1812efbbf00aa8d17d6a6"><code>39a4122</code></a> chore: add additional text to CONTRIBUTING.rst (<a href="https://redirect.github.com/boto/boto3/issues/4749">#4749</a>)</li> <li><a href="https://github.com/boto/boto3/commit/8d65320e4df23b56f3dc5b09ad75d95bcc85382b"><code>8d65320</code></a> Merge branch 'release-1.42.87'</li> <li><a href="https://github.com/boto/boto3/commit/fdcbb88dfbc65c8ef6fd3557f7d37c73ec6a09a2"><code>fdcbb88</code></a> Merge branch 'release-1.42.87' into develop</li> <li>Additional commits viewable in <a href="https://github.com/boto/boto3/compare/1.36.4...1.42.89">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
293ec8f850 |
Python: Bump python-multipart from 0.0.22 to 0.0.26 in /python (#13878)
Bumps [python-multipart](https://github.com/Kludex/python-multipart) from 0.0.22 to 0.0.26. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/python-multipart/releases">python-multipart's releases</a>.</em></p> <blockquote> <h2>Version 0.0.26</h2> <h2>What's Changed</h2> <ul> <li>Skip preamble before first multipart boundary by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/262">Kludex/python-multipart#262</a></li> <li>Silently discard epilogue data after the closing boundary by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/259">Kludex/python-multipart#259</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.25...0.0.26">https://github.com/Kludex/python-multipart/compare/0.0.25...0.0.26</a></p> <h2>Version 0.0.25</h2> <h2>What's Changed</h2> <ul> <li>Apply Apache-2.0 properly by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/247">Kludex/python-multipart#247</a></li> <li>Handle multipart headers case-insensitively by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/252">Kludex/python-multipart#252</a></li> <li>Emit <code>field_end</code> for trailing bare field names on finalize by <a href="https://github.com/bysiber"><code>@bysiber</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/230">Kludex/python-multipart#230</a></li> <li>Add <code>UPLOAD_DELETE_TMP</code> to <code>FormParser</code> config by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/254">Kludex/python-multipart#254</a></li> <li>Remove custom FormParser classes by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/257">Kludex/python-multipart#257</a></li> <li>Handle CTE values case-insensitively by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/258">Kludex/python-multipart#258</a></li> <li>Add MIME content type info to File by <a href="https://github.com/jhnstrk"><code>@jhnstrk</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/143">Kludex/python-multipart#143</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.24...0.0.25">https://github.com/Kludex/python-multipart/compare/0.0.24...0.0.25</a></p> <h2>Version 0.0.24</h2> <h2>What's Changed</h2> <ul> <li>Validate <code>chunk_size</code> in <code>parse_form()</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/244">Kludex/python-multipart#244</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.23...0.0.24">https://github.com/Kludex/python-multipart/compare/0.0.23...0.0.24</a></p> <h2>Version 0.0.23</h2> <h2>What's Changed</h2> <ul> <li>Remove unused <code>trust_x_headers</code> parameter and <code>X-File-Name</code> fallback by <a href="https://github.com/jhnstrk"><code>@jhnstrk</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/196">Kludex/python-multipart#196</a></li> <li>Return processed length from <code>QuerystringParser._internal_write</code> by <a href="https://github.com/bysiber"><code>@bysiber</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/229">Kludex/python-multipart#229</a></li> <li>Cleanup metadata dunders from <code>__init__.py</code> by <a href="https://github.com/Chesars"><code>@Chesars</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/227">Kludex/python-multipart#227</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Chesars"><code>@Chesars</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/python-multipart/pull/227">Kludex/python-multipart#227</a></li> <li><a href="https://github.com/bysiber"><code>@bysiber</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/python-multipart/pull/229">Kludex/python-multipart#229</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.22...0.0.23">https://github.com/Kludex/python-multipart/compare/0.0.22...0.0.23</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md">python-multipart's changelog</a>.</em></p> <blockquote> <h2>0.0.26 (2026-04-10)</h2> <ul> <li>Skip preamble before the first multipart boundary more efficiently <a href="https://redirect.github.com/Kludex/python-multipart/pull/262">#262</a>.</li> <li>Silently discard epilogue data after the closing multipart boundary <a href="https://redirect.github.com/Kludex/python-multipart/pull/259">#259</a>.</li> </ul> <h2>0.0.25 (2026-04-10)</h2> <ul> <li>Add MIME content type info to <code>File</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/143">#143</a>.</li> <li>Handle CTE values case-insensitively <a href="https://redirect.github.com/Kludex/python-multipart/pull/258">#258</a>.</li> <li>Remove custom <code>FormParser</code> classes <a href="https://redirect.github.com/Kludex/python-multipart/pull/257">#257</a>.</li> <li>Add <code>UPLOAD_DELETE_TMP</code> to <code>FormParser</code> config <a href="https://redirect.github.com/Kludex/python-multipart/pull/254">#254</a>.</li> <li>Emit <code>field_end</code> for trailing bare field names on finalize <a href="https://redirect.github.com/Kludex/python-multipart/pull/230">#230</a>.</li> <li>Handle multipart headers case-insensitively <a href="https://redirect.github.com/Kludex/python-multipart/pull/252">#252</a>.</li> <li>Apply Apache-2.0 properly <a href="https://redirect.github.com/Kludex/python-multipart/pull/247">#247</a>.</li> </ul> <h2>0.0.24 (2026-04-05)</h2> <ul> <li>Validate <code>chunk_size</code> in <code>parse_form()</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/244">#244</a>.</li> </ul> <h2>0.0.23 (2026-04-05)</h2> <ul> <li>Remove unused <code>trust_x_headers</code> parameter and <code>X-File-Name</code> fallback <a href="https://redirect.github.com/Kludex/python-multipart/pull/196">#196</a>.</li> <li>Return processed length from <code>QuerystringParser._internal_write</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/229">#229</a>.</li> <li>Cleanup metadata dunders from <code>__init__.py</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/227">#227</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Kludex/python-multipart/commit/28f47859b4a40c2e11e02dc514b2e9743ceedd2e"><code>28f4785</code></a> Version 0.0.26 (<a href="https://redirect.github.com/Kludex/python-multipart/issues/263">#263</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/d4452a78bbde94995dd3c0d1b4aff3610a5c472f"><code>d4452a7</code></a> Silently discard epilogue data after the closing boundary (<a href="https://redirect.github.com/Kludex/python-multipart/issues/259">#259</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/6a7b76dd2653d99d8e5981d7ff09a4a047750b37"><code>6a7b76d</code></a> Skip preamble before first multipart boundary (<a href="https://redirect.github.com/Kludex/python-multipart/issues/262">#262</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/4addb60350fc843f77a1502f14247db91930b3bf"><code>4addb60</code></a> Version 0.0.25 (<a href="https://redirect.github.com/Kludex/python-multipart/issues/261">#261</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/d3a4698e0dc16cbd85f98076b2ebf9b696cd3604"><code>d3a4698</code></a> Add MIME content type info to File (<a href="https://redirect.github.com/Kludex/python-multipart/issues/143">#143</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/9a1ecbd074801fcd3911266f3f4442181d10ab92"><code>9a1ecbd</code></a> Handle CTE values case-insensitively (<a href="https://redirect.github.com/Kludex/python-multipart/issues/258">#258</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/ef2a0b94f95676ea6a7b77d2252b09f5797cb8ed"><code>ef2a0b9</code></a> Remove custom FormParser classes (<a href="https://redirect.github.com/Kludex/python-multipart/issues/257">#257</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/3a757d7cf209e654eb17cf7b7af868eed469f680"><code>3a757d7</code></a> Ignore local Claude state (<a href="https://redirect.github.com/Kludex/python-multipart/issues/255">#255</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/55e739617db7c40e2cd04c5ad8c7acf2ed0a1d19"><code>55e7396</code></a> fuzz: Add cifuzz (<a href="https://redirect.github.com/Kludex/python-multipart/issues/186">#186</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/d6d1d111e7de9ce3d3f8623fe5f5e4201c0a5fd1"><code>d6d1d11</code></a> Bump the github-actions group with 2 updates (<a href="https://redirect.github.com/Kludex/python-multipart/issues/249">#249</a>)</li> <li>Additional commits viewable in <a href="https://github.com/Kludex/python-multipart/compare/0.0.22...0.0.26">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
4fb5abcc66 |
Python: Bump nbconvert from 7.17.0 to 7.17.1 in /python (#13906)
Bumps [nbconvert](https://github.com/jupyter/nbconvert) from 7.17.0 to 7.17.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jupyter/nbconvert/releases">nbconvert's releases</a>.</em></p> <blockquote> <h2>v7.17.1</h2> <h2>7.17.1</h2> <p>This is a security release, fixing two CVEs:</p> <ul> <li><a href="https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg">CVE-2026-39377</a></li> <li><a href="https://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9">CVE-2026-39378</a></li> </ul> <p>(full advisories will be published seven days after release, on 2026-04-14).</p> <p>(<a href="https://github.com/jupyter/nbconvert/compare/v7.17.0...b3b6ec01f872e9af8fd1769eb9cf1889c720ecf3">Full Changelog</a>)</p> <h3>Enhancements made</h3> <ul> <li>Allow configureable WebPDF JavaScript processing timeout <a href="https://redirect.github.com/jupyter/nbconvert/pull/2250">#2250</a> (<a href="https://github.com/timkpaine"><code>@timkpaine</code></a>, <a href="https://github.com/Carreau"><code>@Carreau</code></a>)</li> </ul> <h3>Bugs fixed</h3> <ul> <li>Fix <code>PermissionError</code> when checking template paths on shared filesystems <a href="https://redirect.github.com/jupyter/nbconvert/pull/2252">#2252</a> (<a href="https://github.com/ctcjab"><code>@ctcjab</code></a>, <a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> <li>Tweak webpdf template logic to fix duplicate extension problem <a href="https://redirect.github.com/jupyter/nbconvert/pull/2249">#2249</a> (<a href="https://github.com/timkpaine"><code>@timkpaine</code></a>, <a href="https://github.com/Carreau"><code>@Carreau</code></a>)</li> </ul> <h3>Maintenance and upkeep improvements</h3> <ul> <li>specify python version for pre <a href="https://redirect.github.com/jupyter/nbconvert/pull/2276">#2276</a> (<a href="https://github.com/minrk"><code>@minrk</code></a>, <a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> </ul> <h3>Contributors to this release</h3> <p>The following people contributed discussions, new ideas, code and documentation contributions, and review. See <a href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports">our definition of contributors</a>.</p> <p>(<a href="https://github.com/jupyter/nbconvert/graphs/contributors?from=2026-01-29&to=2026-04-08&type=c">GitHub contributors page for this release</a>)</p> <p><a href="https://github.com/akhmerov"><code>@akhmerov</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aakhmerov+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/bollwyvl"><code>@bollwyvl</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Abollwyvl+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/Carreau"><code>@Carreau</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/ctcjab"><code>@ctcjab</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Actcjab+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/davidbrochart"><code>@davidbrochart</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Adavidbrochart+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/Ken-B"><code>@Ken-B</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AKen-B+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/krassowski"><code>@krassowski</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Akrassowski+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/mgeier"><code>@mgeier</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Amgeier+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/minrk"><code>@minrk</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/mpacer"><code>@mpacer</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Ampacer+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/MSeal"><code>@MSeal</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AMSeal+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/SylvainCorlay"><code>@SylvainCorlay</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ASylvainCorlay+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/takluyver"><code>@takluyver</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atakluyver+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/timkpaine"><code>@timkpaine</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atimkpaine+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>)</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jupyter/nbconvert/blob/main/CHANGELOG.md">nbconvert's changelog</a>.</em></p> <blockquote> <h2>7.17.1</h2> <p>This is a security release, fixing two CVEs:</p> <ul> <li><a href="https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg">CVE-2026-39377</a></li> <li><a href="https://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9">CVE-2026-39378</a></li> </ul> <p>(full advisories will be published seven days after release, on 2026-04-14).</p> <p>(<a href="https://github.com/jupyter/nbconvert/compare/v7.17.0...b3b6ec01f872e9af8fd1769eb9cf1889c720ecf3">Full Changelog</a>)</p> <h3>Enhancements made</h3> <ul> <li>Allow configureable WebPDF JavaScript processing timeout <a href="https://redirect.github.com/jupyter/nbconvert/pull/2250">#2250</a> (<a href="https://github.com/timkpaine"><code>@timkpaine</code></a>, <a href="https://github.com/Carreau"><code>@Carreau</code></a>)</li> </ul> <h3>Bugs fixed</h3> <ul> <li>Fix <code>PermissionError</code> when checking template paths on shared filesystems <a href="https://redirect.github.com/jupyter/nbconvert/pull/2252">#2252</a> (<a href="https://github.com/ctcjab"><code>@ctcjab</code></a>, <a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> <li>Tweak webpdf template logic to fix duplicate extension problem <a href="https://redirect.github.com/jupyter/nbconvert/pull/2249">#2249</a> (<a href="https://github.com/timkpaine"><code>@timkpaine</code></a>, <a href="https://github.com/Carreau"><code>@Carreau</code></a>)</li> </ul> <h3>Maintenance and upkeep improvements</h3> <ul> <li>specify python version for pre <a href="https://redirect.github.com/jupyter/nbconvert/pull/2276">#2276</a> (<a href="https://github.com/minrk"><code>@minrk</code></a>, <a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> </ul> <h3>Contributors to this release</h3> <p>The following people contributed discussions, new ideas, code and documentation contributions, and review. See <a href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports">our definition of contributors</a>.</p> <p>(<a href="https://github.com/jupyter/nbconvert/graphs/contributors?from=2026-01-29&to=2026-04-08&type=c">GitHub contributors page for this release</a>)</p> <p><a href="https://github.com/akhmerov"><code>@akhmerov</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aakhmerov+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/bollwyvl"><code>@bollwyvl</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Abollwyvl+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/Carreau"><code>@Carreau</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/ctcjab"><code>@ctcjab</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Actcjab+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/davidbrochart"><code>@davidbrochart</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Adavidbrochart+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/Ken-B"><code>@Ken-B</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AKen-B+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/krassowski"><code>@krassowski</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Akrassowski+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/mgeier"><code>@mgeier</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Amgeier+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/minrk"><code>@minrk</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/mpacer"><code>@mpacer</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Ampacer+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/MSeal"><code>@MSeal</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AMSeal+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/SylvainCorlay"><code>@SylvainCorlay</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ASylvainCorlay+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/takluyver"><code>@takluyver</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atakluyver+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/timkpaine"><code>@timkpaine</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atimkpaine+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>)</p> <!-- raw HTML omitted --> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jupyter/nbconvert/commit/78ed30837a607deab7cf0a12dca072bf3f63417a"><code>78ed308</code></a> Publish 7.17.1</li> <li><a href="https://github.com/jupyter/nbconvert/commit/f090a64606fde4c7f87cbf478f51b4aa46a425ec"><code>f090a64</code></a> ruff format</li> <li><a href="https://github.com/jupyter/nbconvert/commit/b3b6ec01f872e9af8fd1769eb9cf1889c720ecf3"><code>b3b6ec0</code></a> chore: update pre-commit hooks (<a href="https://redirect.github.com/jupyter/nbconvert/issues/2277">#2277</a>)</li> <li><a href="https://github.com/jupyter/nbconvert/commit/be4841f7da51c499b1937e41e6e71926dbe0daa3"><code>be4841f</code></a> ignore silly security lint in tests</li> <li><a href="https://github.com/jupyter/nbconvert/commit/26d57b295870f5572d9bd0535acee4a120339c10"><code>26d57b2</code></a> fix type annotation on Lexer</li> <li><a href="https://github.com/jupyter/nbconvert/commit/0e6b8ccabf2aca6c18fac8c574f22b7155f441fb"><code>0e6b8cc</code></a> Merge commit from fork</li> <li><a href="https://github.com/jupyter/nbconvert/commit/ba5e5cdd737704388251fa55fa9e58f5752fa39d"><code>ba5e5cd</code></a> Merge commit from fork</li> <li><a href="https://github.com/jupyter/nbconvert/commit/1db0c88d865146ce02b6405a8d96753d3d0cd0c2"><code>1db0c88</code></a> Specify python version for pre (<a href="https://redirect.github.com/jupyter/nbconvert/issues/2276">#2276</a>)</li> <li><a href="https://github.com/jupyter/nbconvert/commit/7473fc3037a6317bff54380e3a7162d73bf089b3"><code>7473fc3</code></a> chore: update pre-commit hooks (<a href="https://redirect.github.com/jupyter/nbconvert/issues/2242">#2242</a>)</li> <li><a href="https://github.com/jupyter/nbconvert/commit/4322f7f290694929f414cefadc942111afad3762"><code>4322f7f</code></a> Bump the actions group across 1 directory with 2 updates (<a href="https://redirect.github.com/jupyter/nbconvert/issues/2273">#2273</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jupyter/nbconvert/compare/v7.17.0...v7.17.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
5dad51381a |
Python: Bump onnxruntime from 1.22.1 to 1.24.3 in /python (#13868)
Bumps [onnxruntime](https://github.com/microsoft/onnxruntime) from 1.22.1 to 1.24.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/microsoft/onnxruntime/releases">onnxruntime's releases</a>.</em></p> <blockquote> <h2>ONNX Runtime v1.24.3</h2> <p>This is a patch release for ONNX Runtime 1.24, containing bug fixes, security improvements, performance enhancements, and execution provider updates.</p> <h2>Security Fixes</h2> <ul> <li><strong>Core</strong>: Fixed GatherCopyData integer truncation leading to heap out-of-bounds read/write. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27444">#27444</a>)</li> <li><strong>Core</strong>: Fixed RoiAlign heap out-of-bounds read via unchecked batch_indices. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27543">#27543</a>)</li> <li><strong>Core</strong>: Prevent heap OOB from maliciously crafted Lora Adapters. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27518">#27518</a>)</li> <li><strong>Core</strong>: Fixed out-of-bounds access for Resize operation. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27419">#27419</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li><strong>Core</strong>: Fixed GatherND division by zero when batch dimensions mismatch. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27090">#27090</a>)</li> <li><strong>Core</strong>: Fixed validation for external data paths for models loaded from bytes. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27430">#27430</a>)</li> <li><strong>Core</strong>: Fixed SkipLayerNorm fusion incorrectly applied when gamma/beta are not 1D. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27459">#27459</a>)</li> <li><strong>Core</strong>: Fixed double-free in TRT EP custom op domain Release functions. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27471">#27471</a>)</li> <li><strong>Core</strong>: Fixed QMoE CPU Operator. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27360">#27360</a>)</li> <li><strong>Core</strong>: Fixed MatmulNBits prepacking scales. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27412">#27412</a>)</li> <li><strong>Python</strong>: Fixed refcount bug in map input conversion that caused shutdown segfault. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27413">#27413</a>)</li> <li><strong>NuGet</strong>: Fixed DllImportResolver. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27397">#27397</a>)</li> <li><strong>NuGet</strong>: Added <code>OrtEnv.DisableDllImportResolver</code> to prevent fatal error on resolver conflict. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27535">#27535</a>)</li> </ul> <h2>Performance Improvements</h2> <ul> <li><strong>Core</strong>: QMoE CPU performance update (up to 4x on 4-bit). (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27364">#27364</a>)</li> <li><strong>Core</strong>: Fixed O(n²) model load time for TreeEnsemble with categorical feature chains. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27391">#27391</a>)</li> </ul> <h2>Execution Provider Updates</h2> <ul> <li><strong>NvTensorRtRtx EP</strong>: <ul> <li>Avoid repetitive creation of fp4/fp8 native-custom-op domains. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27192">#27192</a>)</li> <li>Added missing override specifiers to suppress warnings. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27288">#27288</a>)</li> <li>DQ→MatMulNBits fusion transformer. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27466">#27466</a>)</li> </ul> </li> <li><strong>WebGPU</strong>: <ul> <li>Used embedded WASM module in Blob URL workers when <code>wasmBinary</code> is provided. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27318">#27318</a>)</li> <li>Fixed usage of <code>wasmBinary</code> together with a blob URL for <code>.mjs</code>. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27411">#27411</a>)</li> <li>Removed the unhelpful "Unknown CPU vendor" warning. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27399">#27399</a>)</li> <li>Allows new memory info name for WebGPU. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27475">#27475</a>)</li> </ul> </li> <li><strong>MLAS</strong>: <ul> <li>Added DynamicQGemm function pointers and ukernel interface. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27403">#27403</a>)</li> <li>Fixed error where bytes is not assigned for dynamic qgemm pack b size. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27421">#27421</a>)</li> </ul> </li> <li><strong>VitisAI EP</strong>: Removed <code>s_kernel_registry_vitisaiep.reset()</code> in <code>deinitialize_vitisai_ep()</code>. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27295">#27295</a>)</li> <li><strong>Plugin EPs</strong>: Added "library_path" metadata entry to <code>OrtEpDevice</code> instances for plugin and provider bridge EPs. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27522">#27522</a>)</li> </ul> <h2>Build and Infrastructure</h2> <ul> <li><strong>Pipelines</strong>: <ul> <li>Build Windows ARM64X binaries as part of packaging pipeline. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27316">#27316</a>)</li> <li>Moved JAR testing pipelines to canonical pipeline template. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27480">#27480</a>)</li> </ul> </li> <li><strong>Python</strong>: Enabled Python 3.14 CI and upgraded dependencies. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27401">#27401</a>)</li> <li><strong>Build</strong>: Suppressed spurious Array Out of Bounds warnings produced by GCC 14.2 compiler on Linux builds. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27454">#27454</a>)</li> <li><strong>Build</strong>: Fixed <code>-Warray-bounds</code> build error in MLAS on clang 17+. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27499">#27499</a>)</li> <li><strong>Telemetry</strong>: Added/Updated telemetry events. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27356">#27356</a>)</li> <li><strong>Config</strong>: Increased <code>kMaxValueLength</code> to 8192. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27521">#27521</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/microsoft/onnxruntime/commit/3a728b75062256951b6e19ce718907cf1a1d4cf0"><code>3a728b7</code></a> ORT 1.24.3 release cherry pick round 4 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27558">#27558</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/dd6a8546ab88c47db73f139854eb25130ef27c9e"><code>dd6a854</code></a> ORT 1.24.3 release cherry pick round 3 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27501">#27501</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/15c006bd76d7af722fd71921611583d8834e9338"><code>15c006b</code></a> ORT 1.24.3 release cherry pick round 2 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27492">#27492</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/ee26608ab699fd98c71df4ddff58720fe7ec54db"><code>ee26608</code></a> ORT 1.24.3 release cherry pick round 1 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27476">#27476</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/058787ceead760166e3c50a0a4cba8a833a6f53f"><code>058787c</code></a> ORT 1.24.2 Release cherry pick round 4 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27388">#27388</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/6fc7ee38cdc5755a7e4ab6cdc26c5f73a2d94dd7"><code>6fc7ee3</code></a> ORT 1.24.2 release cherry pick round 3 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27378">#27378</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/98711820882dc178e995ec24f4587350dbf16360"><code>9871182</code></a> ORT 1.24.2 release cherry-pick round 2 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27343">#27343</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/f34d11d3e99abb3b1c2236f33e0e1aa30160b922"><code>f34d11d</code></a> ORT 1.24.2 release cherry pick round 1 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27330">#27330</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/8ba51c754c3c853e420a38051f76c5d97e78ff89"><code>8ba51c7</code></a> update version to 1.24.2</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/470ae16099a74fe05e31f2530489332c0525edb5"><code>470ae16</code></a> Patch pools to use older agent version on ARM64 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27232">#27232</a>)</li> <li>Additional commits viewable in <a href="https://github.com/microsoft/onnxruntime/compare/v1.22.1...v1.24.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: moonbox3 <[email protected]> |
||
|
dependabot[bot]
|
790add7a33 |
Python: Bump authlib from 1.6.9 to 1.6.11 in /python (#13880)
Bumps [authlib](https://github.com/authlib/authlib) from 1.6.9 to 1.6.11. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/authlib/authlib/releases">authlib's releases</a>.</em></p> <blockquote> <h2>v1.6.11</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/authlib/authlib/compare/v1.6.10...v1.6.11">https://github.com/authlib/authlib/compare/v1.6.10...v1.6.11</a></p> <ul> <li>Fix CSRF issue with starlette client</li> </ul> <h2>v1.6.10</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/authlib/authlib/compare/v1.6.9...v1.6.10">https://github.com/authlib/authlib/compare/v1.6.9...v1.6.10</a></p> <ul> <li>Fix redirecting to unvalidated <code>redirect_uri</code> on <code>UnsupportedResponseTypeError</code>.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/authlib/authlib/blob/v1.6.11/docs/changelog.rst">authlib's changelog</a>.</em></p> <blockquote> <h2>Version 1.6.11</h2> <p><strong>Released on Apr 16, 2026</strong></p> <ul> <li>Fix CSRF vulnerability in the Starlette OAuth client when a <code>cache</code> is configured.</li> </ul> <h2>Version 1.6.10</h2> <p><strong>Released on Apr 13, 2026</strong></p> <ul> <li>Fix redirecting to unvalidated <code>redirect_uri</code> on <code>UnsupportedResponseTypeError</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/authlib/authlib/commit/0dc0e5b4dc84f155319518a3732113af6fa47525"><code>0dc0e5b</code></a> chore: bump to 1.6.11</li> <li><a href="https://github.com/authlib/authlib/commit/aa7b8e46e00d0622658666476782042ac00153a5"><code>aa7b8e4</code></a> Merge commit from fork</li> <li><a href="https://github.com/authlib/authlib/commit/401a7709c3fe43bce1b2105d16a475b688faa788"><code>401a770</code></a> fix: CSRF issue with starlette client</li> <li><a href="https://github.com/authlib/authlib/commit/ef09aebbba4439dedb22bd15777d1b3458b6f0ab"><code>ef09aeb</code></a> chore: release 1.6.10</li> <li><a href="https://github.com/authlib/authlib/commit/3be08468201a7766a93012ce149ea12822cab096"><code>3be0846</code></a> fix: redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError</li> <li>See full diff in <a href="https://github.com/authlib/authlib/compare/v1.6.9...v1.6.11">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Evan Mattson
|
ea9981ffaf |
Python: Docs: Add Microsoft Agent Framework successor callout to READMEs (#13932)
## Motivation and Context Now that **Microsoft Agent Framework (MAF)** is the successor SDK to Semantic Kernel, the top-level and per-language READMEs should direct community members — especially newcomers landing here from search, GitHub, PyPI, or NuGet — to MAF for new work, and clearly state SK's ongoing maintenance posture. ## Description Adds a prominent GitHub `> [!IMPORTANT]` callout, placed directly under the existing title/badges block, to: - `README.md` (top-level) - `python/README.md` - `dotnet/README.md` Each callout: - Names MAF as Semantic Kernel's successor SDK and links to https://github.com/microsoft/agent-framework. - Describes MAF as "an open, multi-language framework for building production-grade AI agents and multi-agent workflows in .NET and Python". - Asks readers to use MAF for the latest abstractions to build agents, workflows, and multi-agent orchestrations. - States that Semantic Kernel will continue to receive minimal security and bug fixes only. No other README content is modified; SK identity, badges, install steps, and quickstart samples are preserved. ## Contribution Checklist - [x] The code builds clean without any errors or warnings — docs-only change. - [x] I didn't break anyone — additive callout only. - [x] All relevant CONTRIBUTING.md sections were followed. |
||
|
Evan Mattson
|
9c62d9d19a |
Python: Bump package version to 1.41.3 for a release (#13926)
### Motivation and Context Bump package version to 1.41.3 for a release <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Bump package version to 1.41.3 for a release <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
Evan Mattson
|
79ef93b9cf |
Python: Extend InMemoryCollection filter attribute blocklist (#13897)
## Summary - Minor defense-in-depth hardening for `InMemoryCollection` filter parsing. - Extends the internal dunder attribute blocklist and adds a regression test covering the blocked set. ## Test plan - [x] `uv run pytest tests/unit/connectors/memory/test_in_memory.py` |
||
|
westey
|
57d9adce81 |
Python: Add field and table name escaping for python SqlServer connector (#13893)
### Motivation and Context ### Description - Add field and table name escaping for python SqlServer connector ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
Evan Mattson
|
20c91a38d1 |
Python: bump py version to 1.41.2 for a release (#13850)
### Motivation and Context bump py version to 1.41.2 for a release <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description bump py version to 1.41.2 for a release <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [X] I didn't break anyone 😄 |
||
|
dependabot[bot]
|
12f14bd911 |
Python: Update ipykernel requirement from ~=6.29 to >=6.29,<8.0 in /python (#13330)
Updates the requirements on [ipykernel](https://github.com/ipython/ipykernel) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ipython/ipykernel/releases">ipykernel's releases</a>.</em></p> <blockquote> <h2>v7.1.0</h2> <h2>7.1.0</h2> <p>IPykernel 7.1.0 fixes an issue where display outputs such as Matplotlib plots were not included when using <code>%notebook</code> magic to save sessions as <code>.ipynb</code> files (<a href="https://redirect.github.com/ipython/ipykernel/issues/1435">#1435</a>). This is enabled using the traitlet <code>ZMQDisplayPublisher.store_display_history</code> which defaults to the previous behaviour of False. This is a minor release rather than a patch release due to the addition of the new traitlet.</p> <p>Output from threads is restored to the pre-6.29 behavior by default (route to latest cell, unless <code>get_ipython().set_parent()</code> is called explicitly from the thread. If it is called, output from that thread will continue to be routed to the same cell). This behavior is now opt-in, instead of unconditional (<a href="https://redirect.github.com/ipython/ipykernel/issues/1451">#1451</a>).</p> <p>This release also fixes bugs that were introduced into the 7.x branch relating to Matplotlib plots in separate windows not being displayed correctly (<a href="https://redirect.github.com/ipython/ipykernel/issues/1458">#1458</a>), kernels launched in new threads failing asserts (<a href="https://redirect.github.com/ipython/ipykernel/issues/1455">#1455</a>), and <code>ContextVar</code>s persisting between cells (<a href="https://redirect.github.com/ipython/ipykernel/issues/1462">#1462</a>). There is also a fix for keyboard interrupts on Windows (<a href="https://redirect.github.com/ipython/ipykernel/issues/1434">#1434</a>).</p> <p>(<a href="https://github.com/ipython/ipykernel/compare/v7.0.1...6f61a6835c217e42c406ee01b359e2fa235baf43">Full Changelog</a>)</p> <h3>Enhancements made</h3> <ul> <li>Store display outputs in history for <code>%notebook</code> magic <a href="https://redirect.github.com/ipython/ipykernel/pull/1435">#1435</a> (<a href="https://github.com/Darshan808"><code>@Darshan808</code></a>)</li> </ul> <h3>Bugs fixed</h3> <ul> <li>fix ContextVar persistence across cells <a href="https://redirect.github.com/ipython/ipykernel/pull/1462">#1462</a> (<a href="https://github.com/minrk"><code>@minrk</code></a>)</li> <li>Fix matplotlib eventloops <a href="https://redirect.github.com/ipython/ipykernel/pull/1458">#1458</a> (<a href="https://github.com/ianthomas23"><code>@ianthomas23</code></a>)</li> <li>Refer to kernel launching thread instead of assuming the main thread <a href="https://redirect.github.com/ipython/ipykernel/pull/1455">#1455</a> (<a href="https://github.com/dfalbel"><code>@dfalbel</code></a>)</li> <li>Fix routing of background thread output when no parent is set explicitly <a href="https://redirect.github.com/ipython/ipykernel/pull/1451">#1451</a> (<a href="https://github.com/minrk"><code>@minrk</code></a>)</li> <li>Fix KeyboardInterrupt on Windows by manually resetting interrupt event <a href="https://redirect.github.com/ipython/ipykernel/pull/1434">#1434</a> (<a href="https://github.com/ptosco"><code>@ptosco</code></a>)</li> </ul> <h3>Maintenance and upkeep improvements</h3> <ul> <li>update pre-commit and related <a href="https://redirect.github.com/ipython/ipykernel/pull/1465">#1465</a> (<a href="https://github.com/Carreau"><code>@Carreau</code></a>)</li> <li>test that matplotlib event loop integration is responsive <a href="https://redirect.github.com/ipython/ipykernel/pull/1463">#1463</a> (<a href="https://github.com/minrk"><code>@minrk</code></a>)</li> <li>update tests for 3.14 <a href="https://redirect.github.com/ipython/ipykernel/pull/1453">#1453</a> (<a href="https://github.com/minrk"><code>@minrk</code></a>)</li> </ul> <h3>Contributors to this release</h3> <p>(<a href="https://github.com/ipython/ipykernel/graphs/contributors?from=2025-10-14&to=2025-10-27&type=c">GitHub contributors page for this release</a>)</p> <p><a href="https://github.com/search?q=repo%3Aipython%2Fipykernel+involves%3ACarreau+updated%3A2025-10-14..2025-10-27&type=Issues"><code>@Carreau</code></a> | <a href="https://github.com/search?q=repo%3Aipython%2Fipykernel+involves%3ADarshan808+updated%3A2025-10-14..2025-10-27&type=Issues"><code>@Darshan808</code></a> | <a href="https://github.com/search?q=repo%3Aipython%2Fipykernel+involves%3Adfalbel+updated%3A2025-10-14..2025-10-27&type=Issues"><code>@dfalbel</code></a> | <a href="https://github.com/search?q=repo%3Aipython%2Fipykernel+involves%3Aianthomas23+updated%3A2025-10-14..2025-10-27&type=Issues"><code>@ianthomas23</code></a> | <a href="https://github.com/search?q=repo%3Aipython%2Fipykernel+involves%3Akrassowski+updated%3A2025-10-14..2025-10-27&type=Issues"><code>@krassowski</code></a> | <a href="https://github.com/search?q=repo%3Aipython%2Fipykernel+involves%3Alumberbot-app+updated%3A2025-10-14..2025-10-27&type=Issues"><code>@lumberbot-app</code></a> | <a href="https://github.com/search?q=repo%3Aipython%2Fipykernel+involves%3Aminrk+updated%3A2025-10-14..2025-10-27&type=Issues"><code>@minrk</code></a> | <a href="https://github.com/search?q=repo%3Aipython%2Fipykernel+involves%3Aptosco+updated%3A2025-10-14..2025-10-27&type=Issues"><code>@ptosco</code></a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ipython/ipykernel/blob/main/CHANGELOG.md">ipykernel's changelog</a>.</em></p> <blockquote> <h2>7.1.0</h2> <p>IPykernel 7.1.0 fixes an issue where display outputs such as Matplotlib plots were not included when using <code>%notebook</code> magic to save sessions as <code>.ipynb</code> files (<a href="https://redirect.github.com/ipython/ipykernel/issues/1435">#1435</a>). This is enabled using the traitlet <code>ZMQDisplayPublisher.store_display_history</code> which defaults to the previous behaviour of False. This is a minor release rather than a patch release due to the addition of the new traitlet.</p> <p>Output from threads is restored to the pre-6.29 behavior by default (route to latest cell, unless <code>get_ipython().set_parent()</code> is called explicitly from the thread. If it is called, output from that thread will continue to be routed to the same cell). This behavior is now opt-in, instead of unconditional (<a href="https://redirect.github.com/ipython/ipykernel/issues/1451">#1451</a>).</p> <p>This release also fixes bugs that were introduced into the 7.x branch relating to Matplotlib plots in separate windows not being displayed correctly (<a href="https://redirect.github.com/ipython/ipykernel/issues/1458">#1458</a>), kernels launched in new threads failing asserts (<a href="https://redirect.github.com/ipython/ipykernel/issues/1455">#1455</a>), and <code>ContextVar</code>s persisting between cells (<a href="https://redirect.github.com/ipython/ipykernel/issues/1462">#1462</a>). There is also a fix for keyboard interrupts on Windows (<a href="https://redirect.github.com/ipython/ipykernel/issues/1434">#1434</a>).</p> <p>(<a href="https://github.com/ipython/ipykernel/compare/v7.0.1...6f61a6835c217e42c406ee01b359e2fa235baf43">Full Changelog</a>)</p> <h3>Enhancements made</h3> <ul> <li>Store display outputs in history for <code>%notebook</code> magic <a href="https://redirect.github.com/ipython/ipykernel/pull/1435">#1435</a> (<a href="https://github.com/Darshan808"><code>@Darshan808</code></a>)</li> </ul> <h3>Bugs fixed</h3> <ul> <li>fix ContextVar persistence across cells <a href="https://redirect.github.com/ipython/ipykernel/pull/1462">#1462</a> (<a href="https://github.com/minrk"><code>@minrk</code></a>)</li> <li>Fix matplotlib eventloops <a href="https://redirect.github.com/ipython/ipykernel/pull/1458">#1458</a> (<a href="https://github.com/ianthomas23"><code>@ianthomas23</code></a>)</li> <li>Refer to kernel launching thread instead of assuming the main thread <a href="https://redirect.github.com/ipython/ipykernel/pull/1455">#1455</a> (<a href="https://github.com/dfalbel"><code>@dfalbel</code></a>)</li> <li>Fix routing of background thread output when no parent is set explicitly <a href="https://redirect.github.com/ipython/ipykernel/pull/1451">#1451</a> (<a href="https://github.com/minrk"><code>@minrk</code></a>)</li> <li>Fix KeyboardInterrupt on Windows by manually resetting interrupt event <a href="https://redirect.github.com/ipython/ipykernel/pull/1434">#1434</a> (<a href="https://github.com/ptosco"><code>@ptosco</code></a>)</li> </ul> <h3>Maintenance and upkeep improvements</h3> <ul> <li>update pre-commit and related <a href="https://redirect.github.com/ipython/ipykernel/pull/1465">#1465</a> (<a href="https://github.com/Carreau"><code>@Carreau</code></a>)</li> <li>test that matplotlib event loop integration is responsive <a href="https://redirect.github.com/ipython/ipykernel/pull/1463">#1463</a> (<a href="https://github.com/minrk"><code>@minrk</code></a>)</li> <li>update tests for 3.14 <a href="https://redirect.github.com/ipython/ipykernel/pull/1453">#1453</a> (<a href="https://github.com/minrk"><code>@minrk</code></a>)</li> </ul> <h3>Contributors to this release</h3> <p>(<a href="https://github.com/ipython/ipykernel/graphs/contributors?from=2025-10-14&to=2025-10-27&type=c">GitHub contributors page for this release</a>)</p> <p><a href="https://github.com/search?q=repo%3Aipython%2Fipykernel+involves%3ACarreau+updated%3A2025-10-14..2025-10-27&type=Issues"><code>@Carreau</code></a> | <a href="https://github.com/search?q=repo%3Aipython%2Fipykernel+involves%3ADarshan808+updated%3A2025-10-14..2025-10-27&type=Issues"><code>@Darshan808</code></a> | <a href="https://github.com/search?q=repo%3Aipython%2Fipykernel+involves%3Adfalbel+updated%3A2025-10-14..2025-10-27&type=Issues"><code>@dfalbel</code></a> | <a href="https://github.com/search?q=repo%3Aipython%2Fipykernel+involves%3Aianthomas23+updated%3A2025-10-14..2025-10-27&type=Issues"><code>@ianthomas23</code></a> | <a href="https://github.com/search?q=repo%3Aipython%2Fipykernel+involves%3Akrassowski+updated%3A2025-10-14..2025-10-27&type=Issues"><code>@krassowski</code></a> | <a href="https://github.com/search?q=repo%3Aipython%2Fipykernel+involves%3Alumberbot-app+updated%3A2025-10-14..2025-10-27&type=Issues"><code>@lumberbot-app</code></a> | <a href="https://github.com/search?q=repo%3Aipython%2Fipykernel+involves%3Aminrk+updated%3A2025-10-14..2025-10-27&type=Issues"><code>@minrk</code></a> | <a href="https://github.com/search?q=repo%3Aipython%2Fipykernel+involves%3Aptosco+updated%3A2025-10-14..2025-10-27&type=Issues"><code>@ptosco</code></a></p> <!-- raw HTML omitted --> <h2>7.0.1</h2> <p>IPykernel 7.0.1 is a bug fix release to support CPython 3.14.</p> <p>(<a href="https://github.com/ipython/ipykernel/compare/v7.0.0...6d9a14a21a8e328e384ebac48e4ccbaad85b1d45">Full Changelog</a>)</p> <h3>Bugs fixed</h3> <ul> <li>Avoid overriding Thread._context in Python 3.14 <a href="https://redirect.github.com/ipython/ipykernel/pull/1447">#1447</a> (<a href="https://github.com/ianthomas23"><code>@ianthomas23</code></a>)</li> </ul> <h3>Maintenance and upkeep improvements</h3> <ul> <li>Fix 7.x license warnings <a href="https://redirect.github.com/ipython/ipykernel/pull/1448">#1448</a> (<a href="https://github.com/bollwyvl"><code>@bollwyvl</code></a>)</li> <li>ci: Test on PyPy 3.11 instead of 3.10 <a href="https://redirect.github.com/ipython/ipykernel/pull/1444">#1444</a> (<a href="https://github.com/cclauss"><code>@cclauss</code></a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ipython/ipykernel/commit/39eaf96ab6db0d0ff9ad269831384c53a11e11d8"><code>39eaf96</code></a> Publish 7.1.0</li> <li><a href="https://github.com/ipython/ipykernel/commit/6f61a6835c217e42c406ee01b359e2fa235baf43"><code>6f61a68</code></a> test that matplotlib event loop integration is responsive (<a href="https://redirect.github.com/ipython/ipykernel/issues/1463">#1463</a>)</li> <li><a href="https://github.com/ipython/ipykernel/commit/8446e02948c390793e129affeceedfa30ed5080f"><code>8446e02</code></a> Fix KeyboardInterrupt on Windows by manually resetting interrupt event (<a href="https://redirect.github.com/ipython/ipykernel/issues/1434">#1434</a>)</li> <li><a href="https://github.com/ipython/ipykernel/commit/dd1e09484854c8dedcd98436bc01b6b8e1cc9034"><code>dd1e094</code></a> update pre-commit and related (<a href="https://redirect.github.com/ipython/ipykernel/issues/1465">#1465</a>)</li> <li><a href="https://github.com/ipython/ipykernel/commit/95f245138589db4f723b8af06107cdfeadc53314"><code>95f2451</code></a> fix ContextVar persistence across cells (<a href="https://redirect.github.com/ipython/ipykernel/issues/1462">#1462</a>)</li> <li><a href="https://github.com/ipython/ipykernel/commit/c56a7aab3cad1fb91f7e7185dc7403d561ecd667"><code>c56a7aa</code></a> Fix matplotlib eventloops (<a href="https://redirect.github.com/ipython/ipykernel/issues/1458">#1458</a>)</li> <li><a href="https://github.com/ipython/ipykernel/commit/c7af34cd19ebcd43f5aafe1919909feb6e898387"><code>c7af34c</code></a> Refer to kernel laucnhing thread instead of assuming the main thread (<a href="https://redirect.github.com/ipython/ipykernel/issues/1455">#1455</a>)</li> <li><a href="https://github.com/ipython/ipykernel/commit/7193d14de447a18470a18d60b81eda5f0048b6aa"><code>7193d14</code></a> Fix routing of background thread output when no parent is set explicitly (<a href="https://redirect.github.com/ipython/ipykernel/issues/1451">#1451</a>)</li> <li><a href="https://github.com/ipython/ipykernel/commit/b8f5dfc3a35a658c66b85213e60f634bd8a44488"><code>b8f5dfc</code></a> Store display outputs in history for <code>%notebook</code> magic (<a href="https://redirect.github.com/ipython/ipykernel/issues/1435">#1435</a>)</li> <li><a href="https://github.com/ipython/ipykernel/commit/93f11dbb02692a7922cb6fdb4ebadffdb8b691c0"><code>93f11db</code></a> update tests for 3.14 (<a href="https://redirect.github.com/ipython/ipykernel/issues/1453">#1453</a>)</li> <li>Additional commits viewable in <a href="https://github.com/ipython/ipykernel/compare/v6.29.0...v7.1.0">compare view</a></li> </ul> </details> <br /> You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
ふぁーandEvan Mattson
|
eeeccb4596 |
Python: Respect FunctionChoiceBehavior filters in OpenAI responses agent tools (#13235)
issue: https://github.com/microsoft/semantic-kernel/issues/13234 ## Summary - honor FunctionChoiceBehavior filters when retrieving kernel function metadata ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 --------- Co-authored-by: Evan Mattson <[email protected]> |
||
|
dependabot[bot]
|
2435461ea9 |
Python: Update pydantic requirement from !=2.10.0,!=2.10.1,!=2.10.2,!=2.10.3,<2.12,>=2.0 to >=2.0,!=2.10.0,!=2.10.1,!=2.10.2,!=2.10.3,<2.13 in /python (#13246)
Updates the requirements on [pydantic](https://github.com/pydantic/pydantic) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic/releases">pydantic's releases</a>.</em></p> <blockquote> <h2>v2.12.1 2025-10-13</h2> <h2>v2.12.1 (2025-10-13)</h2> <p><a href="https://github.com/pydantic/pydantic/releases/tag/v2.12.1">GitHub release</a></p> <h3>What's Changed</h3> <p>This is the first 2.12 patch release, addressing most (but not all yet) regressions from the initial 2.12.0 release.</p> <h4>Fixes</h4> <ul> <li>Do not evaluate annotations when inspecting validators and serializers by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12355">#12355</a></li> <li>Make sure <code>None</code> is converted as <code>NoneType</code> in Python 3.14 by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12370">#12370</a></li> <li>Backport V1 runtime warning when using Python 3.14 by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12367">#12367</a></li> <li>Fix error message for invalid validator signatures by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12366">#12366</a></li> <li>Populate field name in <code>ValidationInfo</code> for validation of default value by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-core/pull/1826">pydantic-core#1826</a></li> <li>Encode credentials in <code>MultiHostUrl</code> builder by <a href="https://github.com/willswire"><code>@willswire</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-core/pull/1829">pydantic-core#1829</a></li> <li>Respect field serializers when using <code>serialize_as_any</code> serialization flag by <a href="https://github.com/davidhewitt"><code>@davidhewitt</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-core/pull/1829">pydantic-core#1829</a></li> <li>Fix various <code>RootModel</code> serialization issues by <a href="https://github.com/davidhewitt"><code>@davidhewitt</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-core/pull/1836">pydantic-core#1836</a></li> </ul> <h3>New Contributors</h3> <ul> <li><a href="https://github.com/willswire"><code>@willswire</code></a> made their first contribution in <a href="https://redirect.github.com/pydantic/pydantic-core/pull/1829">pydantic-core#1829</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/pydantic/compare/v2.12.0...v2.12.1">https://github.com/pydantic/pydantic/compare/v2.12.0...v2.12.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic/blob/v2.12.1/HISTORY.md">pydantic's changelog</a>.</em></p> <blockquote> <h2>v2.12.1 (2025-10-13)</h2> <p><a href="https://github.com/pydantic/pydantic/releases/tag/v2.12.1">GitHub release</a></p> <h3>What's Changed</h3> <p>This is the first 2.12 patch release, addressing most (but not all yet) regressions from the initial 2.12.0 release.</p> <h4>Fixes</h4> <ul> <li>Do not evaluate annotations when inspecting validators and serializers by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12355">#12355</a></li> <li>Make sure <code>None</code> is converted as <code>NoneType</code> in Python 3.14 by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12370">#12370</a></li> <li>Backport V1 runtime warning when using Python 3.14 by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12367">#12367</a></li> <li>Fix error message for invalid validator signatures by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12366">#12366</a></li> <li>Populate field name in <code>ValidationInfo</code> for validation of default value by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-core/pull/1826">pydantic-core#1826</a></li> <li>Encode credentials in <code>MultiHostUrl</code> builder by <a href="https://github.com/willswire"><code>@willswire</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-core/pull/1829">pydantic-core#1829</a></li> <li>Respect field serializers when using <code>serialize_as_any</code> serialization flag by <a href="https://github.com/davidhewitt"><code>@davidhewitt</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-core/pull/1829">pydantic-core#1829</a></li> <li>Fix various <code>RootModel</code> serialization issues by <a href="https://github.com/davidhewitt"><code>@davidhewitt</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-core/pull/1836">pydantic-core#1836</a></li> </ul> <h3>New Contributors</h3> <ul> <li><a href="https://github.com/willswire"><code>@willswire</code></a> made their first contribution in <a href="https://redirect.github.com/pydantic/pydantic-core/pull/1829">pydantic-core#1829</a></li> </ul> <h2>v2.12.0 (2025-10-07)</h2> <p><a href="https://github.com/pydantic/pydantic/releases/tag/v2.12.0">GitHub release</a></p> <h3>What's Changed</h3> <p>This is the final 2.12 release. It features the work of 20 external contributors and provides useful new features, along with initial Python 3.14 support. Several minor changes (considered non-breaking changes according to our <a href="https://docs.pydantic.dev/2.12/version-policy/#pydantic-v2">versioning policy</a>) are also included in this release. Make sure to look into them before upgrading.</p> <p><strong>Note that Pydantic V1 is not compatible with Python 3.14 and greater</strong>.</p> <p>Changes (see the alpha and beta releases for additional changes since 2.11):</p> <h4>Packaging</h4> <ul> <li>Update V1 copy to v1.10.24 by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12338">#12338</a></li> </ul> <h4>New Features</h4> <ul> <li>Add <code>extra</code> parameter to the validate functions by <a href="https://github.com/anvilpete"><code>@anvilpete</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12233">#12233</a></li> <li>Add <code>exclude_computed_fields</code> serialization option by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12334">#12334</a></li> <li>Add <code>preverse_empty_path</code> URL options by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12336">#12336</a></li> <li>Add <code>union_format</code> parameter to JSON Schema generation by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12147">#12147</a></li> <li>Add <code>__qualname__</code> parameter for <code>create_model</code> by <a href="https://github.com/Atry"><code>@Atry</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12001">#12001</a></li> </ul> <h4>Fixes</h4> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pydantic/pydantic/commit/b4076c66773b514d4891f036a4cc562b8ff0ff21"><code>b4076c6</code></a> Prepare release 2.12.1</li> <li><a href="https://github.com/pydantic/pydantic/commit/b67f07291167b4005a6eeee05fcad67b43a53f41"><code>b67f072</code></a> Bump <code>pydantic-core</code> to v2.41.3</li> <li><a href="https://github.com/pydantic/pydantic/commit/529f7ddc4a2eac8eb41b39d8b4d6c07997de46f8"><code>529f7dd</code></a> Fix error message for invalid validator signatures</li> <li><a href="https://github.com/pydantic/pydantic/commit/445fa79f2eda31e2a1922f9736f7613bbd9680b5"><code>445fa79</code></a> Backport V1 runtime warning</li> <li><a href="https://github.com/pydantic/pydantic/commit/b3dba9be0705293019c368d8acc5b8b60dcf5148"><code>b3dba9b</code></a> Make sure <code>None</code> is converted as <code>NoneType</code> in Python 3.14</li> <li><a href="https://github.com/pydantic/pydantic/commit/1e8c41ee1327c153c713f47feb98a5fa7bb8ce89"><code>1e8c41e</code></a> Do not evaluate annotations when inspecting validators and serializers</li> <li><a href="https://github.com/pydantic/pydantic/commit/e2a199fe4fc5f8cbc32c93840c9783b332b4f112"><code>e2a199f</code></a> Upgrade dependencies for 3.14</li> <li><a href="https://github.com/pydantic/pydantic/commit/79353e6a6b9fc7a34304d5981b670832044caa99"><code>79353e6</code></a> Fix spelling in <code>model_dump()</code> docstring</li> <li><a href="https://github.com/pydantic/pydantic/commit/aa6b6cd206253c24a46a5fb830e2ff029d21fb95"><code>aa6b6cd</code></a> Fix typo in experimental.md documentation</li> <li><a href="https://github.com/pydantic/pydantic/commit/a7928e692e5a7841c4379d1af1fd37966941dade"><code>a7928e6</code></a> Update Python version in documentation publishing CI job (<a href="https://redirect.github.com/pydantic/pydantic/issues/12344">#12344</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pydantic/pydantic/compare/v2.0...v2.12.1">compare view</a></li> </ul> </details> <br /> You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]andMark Wallace
|
e052093b64 |
Python: Update pymongo requirement from <4.15,>=4.8.0 to >=4.8.0,<4.16 in /python (#13124)
[//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Updates the requirements on [pymongo](https://github.com/mongodb/mongo-python-driver) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mongodb/mongo-python-driver/releases">pymongo's releases</a>.</em></p> <blockquote> <h2>PyMongo 4.15.0</h2> <p>Community notes: <a href="https://www.mongodb.com/community/forums/t/pymongo-4-15-released/328574">https://www.mongodb.com/community/forums/t/pymongo-4-15-released/328574</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/mongodb/mongo-python-driver/blob/master/doc/changelog.rst">pymongo's changelog</a>.</em></p> <blockquote> <h2>Changes in Version 4.15.0 (2025/09/10)</h2> <p>PyMongo 4.15 brings a number of changes including:</p> <ul> <li>Added :class:<code>~pymongo.encryption_options.TextOpts</code>, :attr:<code>~pymongo.encryption.Algorithm.TEXTPREVIEW</code>, :attr:<code>~pymongo.encryption.QueryType.PREFIXPREVIEW</code>, :attr:<code>~pymongo.encryption.QueryType.SUFFIXPREVIEW</code>, :attr:<code>~pymongo.encryption.QueryType.SUBSTRINGPREVIEW</code>, as part of the experimental Queryable Encryption text queries beta. <code>pymongocrypt>=1.16</code> is required for text query support.</li> <li>Added :class:<code>bson.decimal128.DecimalEncoder</code> and :class:<code>bson.decimal128.DecimalDecoder</code> to support encoding and decoding of BSON Decimal128 values to decimal.Decimal values using the TypeRegistry API.</li> <li>Added support for Windows <code>arm64</code> wheels.</li> </ul> <h2>Changes in Version 4.14.1 (2025/08/19)</h2> <p>Version 4.14.1 is a bug fix release.</p> <ul> <li>Fixed a bug in <code>MongoClient.append_metadata()</code> and <code>AsyncMongoClient.append_metadata()</code> that allowed duplicate <code>DriverInfo.name</code> to be appended to the metadata.</li> </ul> <p>Issues Resolved ...............</p> <p>See the <code>PyMongo 4.14.1 release notes in JIRA</code>_ for the list of resolved issues in this release.</p> <p>.. _PyMongo 4.14.1 release notes in JIRA: <a href="https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=45256">https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=45256</a></p> <h2>Changes in Version 4.14.0 (2025/08/06)</h2> <p>.. warning:: PyMongo 4.14 drops support for MongoDB 4.0. PyMongo now supports MongoDB 4.2+.</p> <p>PyMongo 4.14 brings a number of changes including:</p> <ul> <li> <p>Dropped support for MongoDB 4.0.</p> </li> <li> <p>Added preliminary support for Python 3.14 and 3.14 with free-threading. We do not yet support the following with Python 3.14:</p> <ul> <li>Subinterpreters (<code>concurrent.interpreters</code>)</li> <li>Free-threading with Encryption</li> <li>mod_wsgi</li> </ul> </li> <li> <p>Removed experimental support for free-threading support in Python 3.13.</p> </li> <li> <p>Added :attr:<code>bson.codec_options.TypeRegistry.codecs</code> and</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/1514e9b784ed395e7dad806c7b722fef531ecb15"><code>1514e9b</code></a> Prepare 4.15 release (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2523">#2523</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/98e9f5ecc1396abf2fafe070de36e1bed5691930"><code>98e9f5e</code></a> PYTHON-5538 Clean up uv lock file handling (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2522">#2522</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/d7316afb632fb16e23214ec2a404b308a1054896"><code>d7316af</code></a> PYTHON-5328 CRUD Support in Driver for Prefix/Suffix/Substring Indexes (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2521">#2521</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/7580309e993fdda26dc4ea38ccfd0178e78c99e7"><code>7580309</code></a> PYTHON-4928 Convert CSFLE spec tests to unified test format (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2520">#2520</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/47c5460d2ec7eced587add33cb6ab0d717218f49"><code>47c5460</code></a> Bump pyright from 1.1.404 to 1.1.405 (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2518">#2518</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/b84e1a7ce4f53faf3b4898fdf8b5b89251f8c047"><code>b84e1a7</code></a> PYTHON-5527 - Unified test typo in 'Expected error' (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2517">#2517</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/c0e0554a3b69b7c3140a792934682c19b43fc269"><code>c0e0554</code></a> PYTHON-5521 - Update TestBsonSizeBatches.test_06_insert_fails_over_16MiB erro...</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/d63edf7aea260be286a3bc98e28f961db43a71b0"><code>d63edf7</code></a> PYTHON-5524 - Fix CSFLE spec test min version checks (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2516">#2516</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/b756bbd2a392ee9a810dd9b5df97fc4e16cfae37"><code>b756bbd</code></a> Bump the actions group with 2 updates (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2513">#2513</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/b2bba67b61f033be5360bebc1ea260164ae75bb2"><code>b2bba67</code></a> Update coverage requirement from <=7.10.5,>=5 to >=5,<=7.10.6 (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2512">#2512</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mongodb/mongo-python-driver/compare/4.8.0...4.15.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Mark Wallace <[email protected]> |
||
|
dependabot[bot]andMark Wallace
|
f1b168dc2c |
Python: Update chromadb requirement from <1.1,>=0.5 to >=0.5,<1.4 in /python (#13331)
[//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Updates the requirements on [chromadb](https://github.com/chroma-core/chroma) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/chroma-core/chroma/releases">chromadb's releases</a>.</em></p> <blockquote> <h2>1.3.0</h2> <p>Version: <code>1.3.0</code> Git ref: <code>refs/tags/1.3.0</code> Build Date: <code>2025-10-29T03:08</code> PIP Package: <code>chroma-1.3.0.tar.gz</code> Github Container Registry Image: <code>:1.3.0</code> DockerHub Image: <code>:1.3.0</code></p> <h2>What's Changed</h2> <ul> <li>[ENH] - Adds rust client to list of clients by <a href="https://github.com/tjkrusinskichroma"><code>@tjkrusinskichroma</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5740">chroma-core/chroma#5740</a></li> <li>[ENH]: Integrate task operators into compaction by <a href="https://github.com/tanujnay112"><code>@tanujnay112</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5687">chroma-core/chroma#5687</a></li> <li>[ENH]: Add heaptender client to compaction and make finishtask use this by <a href="https://github.com/tanujnay112"><code>@tanujnay112</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5715">chroma-core/chroma#5715</a></li> <li>[ENH] Add local support for schema by <a href="https://github.com/jairad26"><code>@jairad26</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5714">chroma-core/chroma#5714</a></li> <li>[ENH]: Implement create_task with 2PC and backfill + make it idemptotent by <a href="https://github.com/tanujnay112"><code>@tanujnay112</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5729">chroma-core/chroma#5729</a></li> <li>[CHORE] reconcile schema in compaction orchetrator and use in spann&hnsw by <a href="https://github.com/jairad26"><code>@jairad26</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5742">chroma-core/chroma#5742</a></li> <li>[ENH] Export schema and search types from chromadb.api by <a href="https://github.com/jairad26"><code>@jairad26</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5736">chroma-core/chroma#5736</a></li> <li>Add Sync to roadmap by <a href="https://github.com/kylediaz"><code>@kylediaz</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5745">chroma-core/chroma#5745</a></li> <li>[ENH]: limit concurrency on operators spawned by GC by <a href="https://github.com/codetheweb"><code>@codetheweb</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5720">chroma-core/chroma#5720</a></li> <li>[BLD] Bump hnswlib dep by <a href="https://github.com/Sicheng-Pan"><code>@Sicheng-Pan</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5743">chroma-core/chroma#5743</a></li> <li>[ENH] recognize and flush new metadata keys to schema on local compaction by <a href="https://github.com/jairad26"><code>@jairad26</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5728">chroma-core/chroma#5728</a></li> <li>[ENH]: Error if source_key set but no ef by <a href="https://github.com/sanketkedia"><code>@sanketkedia</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5751">chroma-core/chroma#5751</a></li> <li>[ENH]: (Rust client): add <code>true.into::<Where>()</code> helper by <a href="https://github.com/codetheweb"><code>@codetheweb</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5750">chroma-core/chroma#5750</a></li> <li>Revert "[ENH]: Error if source_key set but no ef" by <a href="https://github.com/sanketkedia"><code>@sanketkedia</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5757">chroma-core/chroma#5757</a></li> <li>[ENH]: Disallow setting only source_key without an ef by <a href="https://github.com/sanketkedia"><code>@sanketkedia</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5758">chroma-core/chroma#5758</a></li> <li>[BUG] use keys instead of key_overrides in query embedding strings by <a href="https://github.com/jairad26"><code>@jairad26</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5754">chroma-core/chroma#5754</a></li> <li>[ENH] Add BM25 embedding function to JS by <a href="https://github.com/jairad26"><code>@jairad26</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5756">chroma-core/chroma#5756</a></li> <li>[CHORE] Bump js ai-embeddings versions by <a href="https://github.com/jairad26"><code>@jairad26</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5759">chroma-core/chroma#5759</a></li> <li>[TST] add space checks & local modify test for schema by <a href="https://github.com/jairad26"><code>@jairad26</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5761">chroma-core/chroma#5761</a></li> <li>[RELEASE] Python 1.3.0 by <a href="https://github.com/jairad26"><code>@jairad26</code></a> in <a href="https://redirect.github.com/chroma-core/chroma/pull/5760">chroma-core/chroma#5760</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/chroma-core/chroma/compare/1.2.2...1.3.0">https://github.com/chroma-core/chroma/compare/1.2.2...1.3.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/chroma-core/chroma/commit/6b30ba6104cb8feeac8c58e39ff1b1f327b343fa"><code>6b30ba6</code></a> [RELEASE] Python 1.3.0 (<a href="https://redirect.github.com/chroma-core/chroma/issues/5760">#5760</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/589bfbc967b8d17c8d6ffad6d12d6de31b4b86fb"><code>589bfbc</code></a> [TST] add space checks & local modify test for schema (<a href="https://redirect.github.com/chroma-core/chroma/issues/5761">#5761</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/810eecc153c915a061cc5b463f00b0a741191ead"><code>810eecc</code></a> [CHORE] Bump js ai-embeddings versions (<a href="https://redirect.github.com/chroma-core/chroma/issues/5759">#5759</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/83252aa0f8d4524908107de70b809b1dad1f7daa"><code>83252aa</code></a> [ENH] Add BM25 embedding function to JS (<a href="https://redirect.github.com/chroma-core/chroma/issues/5756">#5756</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/ff1285d2572bf9ca0018d38c69bd1eae3846f82b"><code>ff1285d</code></a> [BUG] use keys instead of key_overrides in query embedding strings (<a href="https://redirect.github.com/chroma-core/chroma/issues/5754">#5754</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/8e8fb95c2cde9e24b01069947b3b5e613e633ccd"><code>8e8fb95</code></a> [ENH]: Disallow setting only source_key without an ef (<a href="https://redirect.github.com/chroma-core/chroma/issues/5758">#5758</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/0734fdffa5f73ff6886eec9a10d07810d63e99ed"><code>0734fdf</code></a> Revert "[ENH]: Error if source_key set but no ef" (<a href="https://redirect.github.com/chroma-core/chroma/issues/5757">#5757</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/34ebde8d4f8debd5a26d5fd740c85cfbb66379e7"><code>34ebde8</code></a> [ENH]: (Rust client): add <code>true.into::\<Where>()</code> helper (<a href="https://redirect.github.com/chroma-core/chroma/issues/5750">#5750</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/0d3bd2afdcba32f1de74007d3e77bbae89d67849"><code>0d3bd2a</code></a> [ENH]: Error if source_key set but no ef (<a href="https://redirect.github.com/chroma-core/chroma/issues/5751">#5751</a>)</li> <li><a href="https://github.com/chroma-core/chroma/commit/a1ea81a69275bdf25d7526df520d4aab3d82a76d"><code>a1ea81a</code></a> [ENH] recognize and flush new metadata keys to schema on local compaction (<a href="https://redirect.github.com/chroma-core/chroma/issues/5">#5</a>...</li> <li>Additional commits viewable in <a href="https://github.com/chroma-core/chroma/compare/0.5.0...1.3.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Mark Wallace <[email protected]> |
||
|
dependabot[bot]
|
fdc2067b62 |
Python: Update redis[hiredis] requirement from ~=6.0 to >=6,<8 in /python (#13329)
Updates the requirements on [redis[hiredis]](https://github.com/redis/redis-py) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/redis/redis-py/releases">redis[hiredis]'s releases</a>.</em></p> <blockquote> <h2>7.0.1</h2> <h1>Changes</h1> <p>This release adds small fixes related to documentation.</p> <h2>🧰 Maintenance</h2> <ul> <li>Add 'multi_database' section to documentation index (313d93f)</li> <li>Revised multi-database client documentation(78df745)</li> <li>Adding info about Multi-database client in README.md (3f7a55e)</li> </ul> <p>We'd like to thank all the contributors who worked on this release! <a href="https://github.com/dmaier"><code>@dmaier</code></a> <a href="https://github.com/petyaslavova"><code>@petyaslavova</code></a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/redis/redis-py/commit/613a06f5bee94ee8aad3d841dd8c595ae6cc62d2"><code>613a06f</code></a> Updating redis-py package version to 7.0.1</li> <li><a href="https://github.com/redis/redis-py/commit/3f7a55e5914f82787fde15c56c18b105f001745e"><code>3f7a55e</code></a> Adding info about Multi-database client in README.md</li> <li><a href="https://github.com/redis/redis-py/commit/313d93f0b90c69ea5e6c7af8ff9b31ee005f4994"><code>313d93f</code></a> Add 'multi_database' section to documentation index</li> <li><a href="https://github.com/redis/redis-py/commit/78df74522f76341be965e5c719427be6dcd5bedf"><code>78df745</code></a> Revised multi-database client documentation</li> <li><a href="https://github.com/redis/redis-py/commit/7a4e8bc42a1cbda6b1e8e2e1dfbe8a94766e07f9"><code>7a4e8bc</code></a> Updating package version to 7.0.0 and supported redis versions in readme.md</li> <li><a href="https://github.com/redis/redis-py/commit/64a2721d6b0303e7a723066530b467145ee10841"><code>64a2721</code></a> Refactor healthcheck to use PING instead of ECHO (<a href="https://redirect.github.com/redis/redis-py/issues/3811">#3811</a>)</li> <li><a href="https://github.com/redis/redis-py/commit/24a7a1027bd6390e161c1c88be35c8acb242833d"><code>24a7a10</code></a> Fixing SORTABLE, INDEXEMPTY and INDEXMISSING order when using RediSearch fiel...</li> <li><a href="https://github.com/redis/redis-py/commit/32ba6d89d2061a44c0c3f36d249fb9929836fca6"><code>32ba6d8</code></a> DOC-5821 update index/query example for runnable notebook (<a href="https://redirect.github.com/redis/redis-py/issues/3807">#3807</a>)</li> <li><a href="https://github.com/redis/redis-py/commit/c1e566f9fbd99912d7073b871eeda76d70f61b63"><code>c1e566f</code></a> Add handling of empty spaces during CLIENT LIST response parsing (<a href="https://redirect.github.com/redis/redis-py/issues/3797">#3797</a>)</li> <li><a href="https://github.com/redis/redis-py/commit/295bec67ddbf99c205376483f08a3ddebb72f2b2"><code>295bec6</code></a> Adding new ExternalAuthProviderError that will be raised when we receive 'pro...</li> <li>Additional commits viewable in <a href="https://github.com/redis/redis-py/compare/v6.0.0...v7.0.1">compare view</a></li> </ul> </details> <br /> You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
0f322bcc48 |
Python: Improve prompt-template msg serialize and sample usage (#13738)
### Motivation and Context This PR updates the Jinja2 and Handlebars prompt-template helpers to serialize chat messages through the existing XML/message serializer instead of assembling message XML manually. It also aligns the prompt-template samples with the serializer-backed helper and adds regression coverage for common message content. <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Prompt template message serialize improvements. <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 --------- Co-authored-by: MAF Dashboard Bot <[email protected]> Co-authored-by: Copilot <[email protected]> |
||
|
Evan Mattson
|
9d120bcc4a |
Python: Bump Python version to 1.41.1 for a release (#13705)
### Motivation and Context Bump Pythong version to 1.41.1 for a release <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Bump Pythong version to 1.41.1 for a release <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [X] I didn't break anyone 😄 |
||
|
|
41f7b59595 |
Python: fix Google AI/Vertex AI crash on anyOf schema (#12442) (#13624)
### Motivation and Context Closes #12442 When `ChatCompletionAgent` instances are used as plugins with `GoogleAIChatCompletion`, the application crashes with: ``` ValueError: Unknown field for Schema: anyOf ``` **Root cause**: The Semantic Kernel JSON schema builder generates `anyOf` for Union types (e.g. `str | list[str]` on the agent's `messages` parameter) and type-as-array for Optional types (e.g. `["string", "null"]`). Google AI's protobuf `Schema` does not support these constructs. ### Description Add `sanitize_schema_for_google_ai()` to `shared_utils.py` that recursively rewrites unsupported schema constructs: - `anyOf` / `oneOf` with a null variant → single type + `nullable: true` - `anyOf` / `oneOf` without null → picks the first variant - `type` as array (e.g. `["string", "null"]`) → single type + `nullable: true` Applied in both `kernel_function_metadata_to_google_ai_function_call_format()` and `kernel_function_metadata_to_vertex_ai_function_call_format()`. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) - [x] The existing tests pass, and I have added 12 new regression tests - [x] I didn't break any existing functionality > [!NOTE] > AI-assisted contribution: Claude helped with code review, test generation, and formatting. --------- Co-authored-by: Claude Opus 4.6 <[email protected]> Co-authored-by: Evan Mattson <[email protected]> |
||
|
|
83ff0a5aaa |
Python: fix(google-ai): skip api_key check when use_vertexai is True (#13607)
## Summary Fixes #13483 ### Motivation and Context When `use_vertexai=True`, users authenticate via Application Default Credentials (ADC) and don't need an API key. However, the initialization check for `api_key` runs unconditionally, blocking Vertex AI users with: ``` ServiceInitializationError: The API key is required when use_vertexai is False. ``` ### Description Guard the `api_key` validation with `not google_ai_settings.use_vertexai` in all three Google AI service classes: - `GoogleAIChatCompletion` - `GoogleAITextCompletion` - `GoogleAITextEmbedding` The error message already reads *"when use_vertexai is False"*, so the condition now matches the intent. ### Before / After ```python # Before — fails even with use_vertexai=True GoogleAIChatCompletion( use_vertexai=True, cloud_project_id="my-project", cloud_region="us-central1" ) # → ServiceInitializationError: The API key is required when use_vertexai is False. # After — works correctly GoogleAIChatCompletion( use_vertexai=True, cloud_project_id="my-project", cloud_region="us-central1" ) # → Initializes successfully, uses ADC for authentication ``` ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) - [x] The code follows the [SK coding standards](https://github.com/microsoft/semantic-kernel/blob/main/python/README.md) --------- Co-authored-by: giulio-leone <[email protected]> Co-authored-by: giulio-leone <[email protected]> Co-authored-by: Copilot <[email protected]> |
||
|
|
e0bd528cd9 |
Python: Default Dapr module allowlist to semantic_kernel prefix (#13596)
### Motivation and Context Follow-up to #13499. The previous PR added the `allowed_module_prefixes` parameter but defaulted it to `None`, which meant the module restriction was only active if developers discovered and configured it. Secure-by-default is the right posture here — restrict first, let developers widen as needed. - Change `allowed_module_prefixes` default from `None` to `("semantic_kernel.",)` across Dapr runtime step loading - Non-SK step classes now require developers to explicitly add their module prefix (e.g. `("semantic_kernel.", "myapp.steps.")`) - Developers can pass `None` to opt out entirely, but the secure default is now enforced - The Dapr runtime code is experimental, so this is a non-breaking change per our stability guarantees <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 --------- Co-authored-by: MAF Dashboard Bot <[email protected]> Co-authored-by: Copilot <[email protected]> |
||
|
|
f034ed1d4c |
Python: fix: ChatHistoryTruncationReducer orphans TOOL role messages (#13608)
## Summary Fixes #12708 `ChatHistoryTruncationReducer.reduce()` can orphan `TOOL` role messages by truncating the preceding `assistant` message that contains the `tool_calls`, causing OpenAI to reject the history with: ``` messages with role 'tool' must be a response to a preceding message with 'tool_calls' ``` ## Root Cause `locate_safe_reduction_index()` uses `contains_function_call_or_result()` to detect tool-related messages during its backward scan. This function only checks `msg.items` for `FunctionCallContent`/`FunctionResultContent` instances. However, `TOOL` role messages can contain only text content (no `FunctionResultContent` in `items`), which causes the backward scan to treat them as regular messages. The truncation point then lands between the `tool_calls` assistant message and its `TOOL` responses, orphaning the tool results. ## Fix Added `AuthorRole.TOOL` check to `contains_function_call_or_result()`: ```python if msg.role == AuthorRole.TOOL: return True ``` This ensures **any** `TOOL` role message is recognized as part of a tool call/result pair, regardless of whether it has `FunctionResultContent` in its `items`. ## Test Added `test_locate_safe_reduction_index_tool_role_without_function_result_content` that verifies TOOL role messages with only text content are not separated from their tool call. --------- Co-authored-by: giulio-leone <[email protected]> Co-authored-by: Evan Mattson <[email protected]> Co-authored-by: Copilot <[email protected]> |
||
|
|
3c1b688dcf |
Python: Fix ChatHistoryTruncationReducer deleting system prompt (#13610)
## Summary `ChatHistoryTruncationReducer.reduce()` silently deletes system/developer messages when truncating chat history. This is because it calls `extract_range()`, which unconditionally filters out system/developer messages — a function designed for the summarization use case, not truncation. Fixes #12612. ## Approach Port the .NET SDK fix (PR #10344) to Python: 1. Detect the first system/developer message before truncation 2. Pass `has_system_message=True` to `locate_safe_reduction_index` so `target_count` accounts for the preserved message (matches .NET's `targetCount -= hasSystemMessage ? 1 : 0`) 3. Use a simple `history[truncation_index:]` slice instead of `extract_range` (which strips system messages) 4. Prepend the system message if it was truncated away Also adds a guard for `target_count <= 0` after the system message adjustment to prevent `IndexError` when `target_count=1`. ## Changes | File | Change | |------|--------| | `chat_history_reducer_utils.py` | Add `has_system_message` parameter, adjust `target_count`, guard against `<= 0` | | `chat_history_truncation_reducer.py` | Detect system message, bypass `extract_range`, prepend if truncated | | `test_chat_history_truncation_reducer.py` | Update 2 existing tests + 4 new tests (system, developer, no-system, target_count=1) | ## Note The summarization reducer (`ChatHistorySummarizationReducer`) has the same bug — it also uses `extract_range` and loses system messages during summarization. The .NET summarization reducer preserves system messages via `AssemblySummarizedHistory`. This should be addressed in a follow-up PR to keep this change focused. ## Test plan - [x] 11/11 truncation reducer tests pass (was 7, now 11) - [x] 9/9 utils tests pass (no regressions from new parameter) - [x] 11/11 summarization reducer tests pass (unaffected) - [x] Reproduces and fixes the exact scenario from #12612 - [x] Edge case: `target_count=1` with system message does not crash --------- Co-authored-by: Claude Opus 4.6 <[email protected]> Co-authored-by: Evan Mattson <[email protected]> |
||
|
dependabot[bot]
|
620e412c70 |
Python: Bump werkzeug from 3.1.1 to 3.1.6 in /python (#13605)
Bumps [werkzeug](https://github.com/pallets/werkzeug) from 3.1.1 to 3.1.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pallets/werkzeug/releases">werkzeug's releases</a>.</em></p> <blockquote> <h2>3.1.6</h2> <p>This is the Werkzeug 3.1.6 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.</p> <p>PyPI: <a href="https://pypi.org/project/Werkzeug/3.1.6/">https://pypi.org/project/Werkzeug/3.1.6/</a> Changes: <a href="https://werkzeug.palletsprojects.com/page/changes/#version-3-1-6">https://werkzeug.palletsprojects.com/page/changes/#version-3-1-6</a></p> <ul> <li><code>safe_join</code> on Windows does not allow special devices names in multi-segment paths. <a href="https://github.com/pallets/werkzeug/security/advisories/GHSA-29vq-49wr-vm6x">GHSA-29vq-49wr-vm6x</a></li> </ul> <h2>3.1.5</h2> <p>This is the Werkzeug 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.</p> <p>PyPI: <a href="https://pypi.org/project/Werkzeug/3.1.5/">https://pypi.org/project/Werkzeug/3.1.5/</a> Changes: <a href="https://werkzeug.palletsprojects.com/page/changes/#version-3-1-5">https://werkzeug.palletsprojects.com/page/changes/#version-3-1-5</a> Milestone: <a href="https://github.com/pallets/werkzeug/milestone/43?closed=1">https://github.com/pallets/werkzeug/milestone/43?closed=1</a></p> <ul> <li><code>safe_join</code> on Windows does not allow more special device names, regardless of extension or surrounding spaces. <a href="https://github.com/pallets/werkzeug/security/advisories/GHSA-87hc-h4r5-73f7">GHSA-87hc-h4r5-73f7</a></li> <li>The multipart form parser handles a <code>\r\n</code> sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. <a href="https://redirect.github.com/pallets/werkzeug/issues/3065">#3065</a> <a href="https://redirect.github.com/pallets/werkzeug/issues/3077">#3077</a></li> <li>Fix <code>AttributeError</code> when initializing <code>DebuggedApplication</code> with <code>pin_security=False</code>. <a href="https://redirect.github.com/pallets/werkzeug/issues/3075">#3075</a></li> </ul> <h2>3.1.4</h2> <p>This is the Werkzeug 3.1.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.</p> <p>PyPI: <a href="https://pypi.org/project/Werkzeug/3.1.4/">https://pypi.org/project/Werkzeug/3.1.4/</a> Changes: <a href="https://werkzeug.palletsprojects.com/page/changes/#version-3-1-4">https://werkzeug.palletsprojects.com/page/changes/#version-3-1-4</a> Milestone: <a href="https://github.com/pallets/werkzeug/milestone/42?closed=1">https://github.com/pallets/werkzeug/milestone/42?closed=1</a></p> <ul> <li><code>safe_join</code> on Windows does not allow special device names. This prevents reading from these when using <code>send_from_directory</code>. <code>secure_filename</code> already prevented writing to these. <a href="https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2">ghsa-hgf8-39gv-g3f2</a></li> <li>The debugger pin fails after 10 attempts instead of 11. <a href="https://redirect.github.com/pallets/werkzeug/issues/3020">#3020</a></li> <li>The multipart form parser handles a <code>\r\n</code> sequence at a chunk boundary. <a href="https://redirect.github.com/pallets/werkzeug/issues/3065">#3065</a></li> <li>Improve CPU usage during Watchdog reloader. <a href="https://redirect.github.com/pallets/werkzeug/issues/3054">#3054</a></li> <li><code>Request.json</code> annotation is more accurate. <a href="https://redirect.github.com/pallets/werkzeug/issues/3067">#3067</a></li> <li>Traceback rendering handles when the line number is beyond the available source lines. <a href="https://redirect.github.com/pallets/werkzeug/issues/3044">#3044</a></li> <li><code>HTTPException.get_response</code> annotation and doc better conveys the distinction between WSGI and sans-IO responses. <a href="https://redirect.github.com/pallets/werkzeug/issues/3056">#3056</a></li> </ul> <h2>3.1.3</h2> <p>This is the Werkzeug 3.1.3 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.</p> <p>PyPI: <a href="https://pypi.org/project/Werkzeug/3.1.3/">https://pypi.org/project/Werkzeug/3.1.3/</a> Changes: <a href="https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-3">https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-3</a> Milestone: <a href="https://github.com/pallets/werkzeug/milestone/41?closed=1">https://github.com/pallets/werkzeug/milestone/41?closed=1</a></p> <ul> <li>Initial data passed to <code>MultiDict</code> and similar interfaces only accepts <code>list</code>, <code>tuple</code>, or <code>set</code> when passing multiple values. It had been changed to accept any <code>Collection</code>, but this matched types that should be treated as single values, such as <code>bytes</code>. <a href="https://redirect.github.com/pallets/werkzeug/issues/2994">#2994</a></li> <li>When the <code>Host</code> header is not set and <code>Request.host</code> falls back to the WSGI <code>SERVER_NAME</code> value, if that value is an IPv6 address it is wrapped in <code>[]</code> to match the <code>Host</code> header. <a href="https://redirect.github.com/pallets/werkzeug/issues/2993">#2993</a></li> </ul> <h2>3.1.2</h2> <p>This is the Werkzeug 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.</p> <p>PyPI: <a href="https://pypi.org/project/Werkzeug/3.1.2/">https://pypi.org/project/Werkzeug/3.1.2/</a> Changes: <a href="https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-2">https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-2</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pallets/werkzeug/blob/main/CHANGES.rst">werkzeug's changelog</a>.</em></p> <blockquote> <h2>Version 3.1.6</h2> <p>Released 2026-02-19</p> <ul> <li><code>safe_join</code> on Windows does not allow special devices names in multi-segment paths. :ghsa:<code>29vq-49wr-vm6x</code></li> </ul> <h2>Version 3.1.5</h2> <p>Released 2026-01-08</p> <ul> <li><code>safe_join</code> on Windows does not allow more special device names, regardless of extension or surrounding spaces. :ghsa:<code>87hc-h4r5-73f7</code></li> <li>The multipart form parser handles a <code>\r\n</code> sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. :issue:<code>3065</code> :issue:<code>3077</code></li> <li>Fix <code>AttributeError</code> when initializing <code>DebuggedApplication</code> with <code>pin_security=False</code>. :issue:<code>3075</code></li> </ul> <h2>Version 3.1.4</h2> <p>Released 2025-11-28</p> <ul> <li><code>safe_join</code> on Windows does not allow special device names. This prevents reading from these when using <code>send_from_directory</code>. <code>secure_filename</code> already prevented writing to these. :ghsa:<code>hgf8-39gv-g3f2</code></li> <li>The debugger pin fails after 10 attempts instead of 11. :pr:<code>3020</code></li> <li>The multipart form parser handles a <code>\r\n</code> sequence at a chunk boundary. :issue:<code>3065</code></li> <li>Improve CPU usage during Watchdog reloader. :issue:<code>3054</code></li> <li><code>Request.json</code> annotation is more accurate. :issue:<code>3067</code></li> <li>Traceback rendering handles when the line number is beyond the available source lines. :issue:<code>3044</code></li> <li><code>HTTPException.get_response</code> annotation and doc better conveys the distinction between WSGI and sans-IO responses. :issue:<code>3056</code></li> </ul> <h2>Version 3.1.3</h2> <p>Released 2024-11-08</p> <ul> <li>Initial data passed to <code>MultiDict</code> and similar interfaces only accepts <code>list</code>, <code>tuple</code>, or <code>set</code> when passing multiple values. It had been changed to accept any <code>Collection</code>, but this matched types that should be</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pallets/werkzeug/commit/04da1b5221b7a7b57e82246e4b5741d37a6b2e56"><code>04da1b5</code></a> release version 3.1.6</li> <li><a href="https://github.com/pallets/werkzeug/commit/f407712fdc60a09c2b3f4fe7db557703e5d9338d"><code>f407712</code></a> Merge commit from fork</li> <li><a href="https://github.com/pallets/werkzeug/commit/f54fe98026253e70fbbcd35a6b52fb67cfff1c03"><code>f54fe98</code></a> safe_join prevents Windows special device names in multi-segment paths</li> <li><a href="https://github.com/pallets/werkzeug/commit/d005985ef69ffe3275eda8fb6fb25e074dbe871b"><code>d005985</code></a> start version 3.1.6</li> <li><a href="https://github.com/pallets/werkzeug/commit/8565c2cbd6681ae8463e77d4fc0795324a7fdae7"><code>8565c2c</code></a> document rule priority (<a href="https://redirect.github.com/pallets/werkzeug/issues/3102">#3102</a>)</li> <li><a href="https://github.com/pallets/werkzeug/commit/3febc7e90072bffe04c27e6b7478dfc4f88930df"><code>3febc7e</code></a> document rule priority</li> <li><a href="https://github.com/pallets/werkzeug/commit/2525b827646c10ab7adb334664e6a4af1b769181"><code>2525b82</code></a> remove state machine docs</li> <li><a href="https://github.com/pallets/werkzeug/commit/4abfbd553cdeb6d4e6fa693340d52b13c884079f"><code>4abfbd5</code></a> rewrite build docstring (<a href="https://redirect.github.com/pallets/werkzeug/issues/3097">#3097</a>)</li> <li><a href="https://github.com/pallets/werkzeug/commit/161c18b2a8800ae6ef377fb3cbdb933a878fea67"><code>161c18b</code></a> rewrite build docstring</li> <li><a href="https://github.com/pallets/werkzeug/commit/86e11c29e44726dae524cd9db11549b3b1ad681d"><code>86e11c2</code></a> release version 3.1.5 (<a href="https://redirect.github.com/pallets/werkzeug/issues/3085">#3085</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pallets/werkzeug/compare/3.1.1...3.1.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Weiguang LiandEvan Mattson
|
e500f727ed |
Python: fix prompt template engine blocking HTML tags in content (#13633)
### Motivation and Context Fixes #13632 When a prompt contains HTML tags such as `<p>`, `<div>`, `<b>`, etc., the `ChatHistory.from_rendered_prompt()` method wraps the rendered prompt in a `<root>` element and parses it as XML. Any child elements whose tag names do not match the known SK template tags (`message`, `chat_history`) were silently skipped, causing their text content to be lost. This meant a prompt like: ``` Translate: "<p>What is your name?</p>" ``` would arrive at the LLM as an empty message, because `<p>What is your name?</p>` was discarded during XML traversal. ### Description In `ChatHistory.from_rendered_prompt`, when an XML child element has an unrecognized tag (i.e. it is not `message` or `chat_history`), the element is now serialized back to its original text representation and appended to the preceding message content. The element's tail text is likewise kept in the same message, preserving the full original prompt text. **Changed files:** - `python/semantic_kernel/contents/chat_history.py` -- handle unknown XML tags as literal text in `from_rendered_prompt()` - `python/tests/unit/contents/test_chat_history.py` -- added four regression tests covering HTML `<p>`, multiple HTML tags, HTML surrounded by text, and SK tags mixed with HTML ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) - [x] The existing tests pass and new tests have been added - [x] I didn't break any existing functionality --------- Co-authored-by: Evan Mattson <[email protected]> |
||
|
Evan Mattson
|
3f6d72725f |
Python: Fix image integration tests that are now blocked due to bot policies (#13680)
### Motivation and Context Fix image integration tests that are now blocked due to bot policies <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Fix image integration tests that are now blocked due to bot policies <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
|
cc83889787 |
Python: fix(python/google): preserve thought_signature in Gemini function call parts (#13609)
### Motivation and Context Fixes #13480 When using Gemini models (2.5 Pro / 3 Pro) with thinking enabled, the API returns a `thought_signature` on function call `Part` objects. Per [Google's Thought Signatures documentation](https://ai.google.dev/gemini-api/docs/thought-signatures), this signature **must** be included in subsequent requests. Without it, follow-up turns with tool results fail with: ``` HTTP 400: Function call is missing a thought_signature in functionCall parts ``` The .NET connector was already fixed in #13418. This PR applies the equivalent fix to the Python connector. ### Description **Response parsing** (capture `thought_signature`): - `google_ai_chat_completion.py`: When creating `FunctionCallContent` from response parts, capture `part.thought_signature` into `FunctionCallContent.metadata` (both non-streaming and streaming paths) - `vertex_ai_chat_completion.py`: Same capture via `part_dict.get("thought_signature")` for Vertex AI **Request building** (restore `thought_signature`): - `google_ai/services/utils.py`: In `format_assistant_message()`, when a `FunctionCallContent` has `thought_signature` in its metadata, construct the `Part` directly with the `thought_signature` parameter instead of using `Part.from_function_call()` - `vertex_ai/services/utils.py`: In `format_assistant_message()`, include `thought_signature` in the `Part.from_dict()` dictionary when present **Backward compatible**: When `thought_signature` is not present (thinking disabled or older models), behavior is identical to before. ### Test Coverage Added 4 new tests: - `test_format_assistant_message_with_thought_signature` (Google AI) — verifies round-trip preservation - `test_format_assistant_message_without_thought_signature` (Google AI) — verifies backward compatibility - `test_format_assistant_message_with_thought_signature` (Vertex AI) — verifies round-trip preservation - `test_format_assistant_message_without_thought_signature` (Vertex AI) — verifies backward compatibility All 110 existing Google connector tests continue to pass. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) - [x] All unit tests pass, and I have added new tests - [x] I didn't break anyone 😄 --------- Co-authored-by: giulio-leone <[email protected]> Co-authored-by: Copilot <[email protected]> |