### Motivation and Context
Prepares the Semantic Kernel Python package for the `1.45.0` release
after #14551 and #14552 merged.
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Updates `semantic_kernel.__version__` from `1.44.1` to `1.45.0`.
Validated the publishable package with `uv build --no-sources`; it
produced:
- `semantic_kernel-1.45.0.tar.gz`
- `semantic_kernel-1.45.0-py3-none-any.whl`
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
Align CrewAI task identifier handling across the .NET and Python clients
and fail early for unsupported identifier formats.
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
- Validate CrewAI status task identifiers consistently in both
implementations.
- Add focused unit coverage for accepted and rejected identifier
formats.
- Preserve valid identifiers unchanged in outgoing status requests.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
---------
Co-authored-by: Copilot App <[email protected]>
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
Improve consistency and maintainability of HTTP request validation in
the .NET and Python SDKs.
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
- Extract existing request validation into shared internal utilities and
reuse them in the HTTP plugins.
- Update HTTP plugin configuration and documentation.
- Extend unit coverage for shared validation and plugin behavior.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
---------
Co-authored-by: Copilot App <[email protected]>
### Motivation and Context
Preserve established behavior while making the default configuration
more visible to users.
### Description
- Preserve established default behavior.
- Add a targeted configuration warning.
- Keep explicit validation behavior unchanged and add focused tests.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
Keep raw session download filenames as filename data when constructing
request URLs, while preserving ordinary nested paths.
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
- URL-encode `remote_file_name`, preserving `/` separators for nested
paths.
- Reject literal `.` and `..` path components with
`FunctionExecutionException` before authentication or a request, and
document this constraint.
- Add HTTPX transport-based tests for ordinary and nested filenames,
special characters, literal percent escapes, and early rejection.
Confirm that `download_file` remains outside normal kernel-function
registration.
**Validation** (from `python/`, using an existing uv-managed
environment):
- `uv run --no-sync --no-env-file python -m pytest
tests/unit/core_plugins/test_sessions_python_plugin.py
--disable-warnings`: passed, 74 tests; 14 warnings.
- `uv run --no-sync --no-env-file python -m ruff check --no-cache
semantic_kernel/core_plugins/sessions_python_tool/sessions_python_plugin.py
tests/unit/core_plugins/test_sessions_python_plugin.py`: passed.
- `uv run --no-sync --no-env-file python -m ruff format --check
--no-cache
semantic_kernel/core_plugins/sessions_python_tool/sessions_python_plugin.py
tests/unit/core_plugins/test_sessions_python_plugin.py`: passed.
- `uv run --no-sync --no-env-file python -m mypy --config-file mypy.ini
--follow-imports=silent
semantic_kernel/core_plugins/sessions_python_tool/sessions_python_plugin.py`:
passed.
Installed pre-commit hooks passed during the commit, including
pyupgrade, Ruff, Ruff formatting, and Bandit.
The repository-wide build, all-files pre-commit checks, and full
unit/integration suites were not run.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
### Motivation and Context
Fixes#14312.
`validate_server_url`
(`connectors/openapi_plugin/server_url_validator.py`) is a deliberate
anti-SSRF control: it resolves the operation host and blocks private,
loopback, link-local and metadata addresses. It then returned `None`,
discarding the addresses it had just vetted.
`OpenApiRunner.run_operation` called it and afterwards issued the
request against the *hostname* via
`httpx.AsyncClient(...).request(url=...)`, so httpx resolved the name a
second time when opening the connection. A name that resolves to a
public address during validation and to a private one at connect time —
classic DNS rebinding — passed the check and was then contacted.
`run_operation` attaches `auth_callback` credentials to that request.
**Severity, stated without inflation.** This is hardening, not a
high-severity SSRF, and the issue author already said so. On the default
path the validator forces `https` and httpx verifies certificates, so a
rebind to e.g. `169.254.169.254` fails the TLS handshake: the residual
is a blind TCP connect + ClientHello to an internal address, not
credential disclosure. Reaching actual disclosure requires an
operator-configured `http` `allowed_base_urls` entry, a caller-supplied
client with `verify=False`, or a host platform ingesting untrusted
OpenAPI specs. The feature is `@experimental`. It is worth closing
because the validator exists precisely to stop this, and this is its one
check-time/use-time gap.
### Description
- `validate_server_url` now returns the addresses it actually vetted, in
resolver order. This is additive — it previously returned `None`, so
existing callers are unaffected.
- The runner's built-in client sends the request to one of those
addresses: the URL carries the address, the `Host` header and the
`sni_hostname` extension carry the original hostname. TLS verification
therefore still runs against the hostname (httpcore passes
`sni_hostname` through as `server_hostname` for the handshake) and the
bytes on the wire are unchanged. `httpx.URL.copy_with(host=...)`
preserves IPv6 bracketing, the port and userinfo.
- Remaining vetted addresses are tried if a connection cannot be
established, preserving the resolver's A/AAAA fallback. Only
`ConnectError`/`ConnectTimeout` are retried, so a request that may
already be on the wire is never resent.
- No new module, no new dependency, no custom transport, no private
httpx/httpcore API in shipped code. `sni_hostname` is httpx's documented
extension for exactly this case.
Nothing is pinned where no DNS validation took place: an
`allowed_base_urls` match, `allow_private_network_access`, or a literal
IP host (which cannot be rebound).
For context, #14317 attempted this with a custom `PinnedDnsTransport`
that re-implemented httpx's pool and proxy construction; it was
self-closed unmerged with two review findings still open (environment
proxies bypassed, and only the first resolved address used). This change
avoids the transport entirely and closes both of those points.
### What this does NOT cover
- **Caller-supplied `http_client`** is not pinned. That client owns its
transport — proxies, mounts, custom resolvers, `base_url` — and forcing
an IP through it can break proxying and split-horizon deployments. Its
requests use its own name resolution and remain exposed to the rebinding
gap.
- **Environment proxies** disable pinning on the default path too. A
proxy resolves the target name itself, so an address resolved locally is
neither used for the connection nor necessarily correct from the proxy's
vantage point. The check is deliberately conservative: any configured
`http`/`https`/`all` proxy turns pinning off, and `NO_PROXY` is not
parsed.
- **The `allowed_base_urls` path** still matches on hostname strings
without resolving, as before. Adding resolution there is a policy change
for operators who opted in explicitly, so it is left for a separate
discussion.
- **Redirects are not re-validated.** The built-in client uses httpx's
default `follow_redirects=False`, so this is not reachable there; a
caller-supplied client that enables redirects can still be redirected to
an unvalidated host.
### Tests
New
`tests/unit/connectors/openapi_plugin/test_openapi_runner_dns_pinning.py`
(12 tests):
| Test | What it proves |
| --- | --- |
| `..._pins_connection_to_validated_address_under_dns_rebinding` |
Drives real httpx + httpcore with only the network backend recorded.
First resolution returns a public address, later ones return
`169.254.169.254`. Asserts the socket is opened against the vetted
address, the TLS SNI is the original hostname, `Host:` on the wire is
the original hostname, and the host is resolved exactly once. |
| `..._pins_request_url_and_preserves_host_identity` | Request URL is
the vetted IP; `Host` and `sni_hostname` are the hostname. |
| `..._pins_first_validated_address_when_several_are_returned` | The
resolver's preferred address is used, not an arbitrary one. |
| `..._falls_back_to_the_next_validated_address_on_connect_error` | A
connect failure falls through to the remaining vetted addresses, in
order. |
| `..._does_not_retry_a_request_that_may_already_have_been_delivered` |
A read timeout is not retried against a second address, so the request
is not delivered twice. |
| `..._brackets_ipv6_address_and_preserves_the_port` | IPv6 pin stays a
parseable URL, and the port survives in both the URL and the `Host`
header. |
| `..._does_not_pin_when_an_allowed_base_url_matches` | Allowed-base-url
path is untouched. |
| `..._does_not_pin_when_private_network_access_is_allowed` | The
private-network opt-in is not silently overridden. |
| `..._does_not_pin_a_literal_ip_host` | A literal address is left
exactly as it was. |
| `..._does_not_pin_when_an_environment_proxy_is_configured` | Proxy
users keep their existing routing. |
| `..._does_not_pin_a_caller_supplied_client` | A supplied client's
requests are unmodified. |
| `..._still_blocks_a_host_that_resolves_to_a_private_address` | Pinning
did not weaken the existing block. |
Plus 5 tests in `test_server_url_validator.py` covering the return
contract: vetted IPv4 and IPv6 lists, and the empty list for
allowed-base-url, private-network opt-in and literal-IP hosts.
Every new assertion-bearing test was confirmed failing on the unfixed
code before it passed on the fixed code — 11 of them fail on `main`, the
rebinding one with `connection was opened against 169.254.169.254, not
the validated address`. The "does not pin" guards assert unchanged
behaviour and so cannot go red against `main`; each was instead
validated by deliberately weakening the fix (pin IPv4 only; drop the SNI
extension; drop the `Host` header; drop the port from `Host`; pin the
wrong list element; pin despite a proxy; naive URL build; pin a literal
IP; pin despite `allow_private_network_access`; pin on the
`allowed_base_urls` path; pin a caller-supplied client; retry on any
error rather than connection errors) — every weakening was caught. The
last two of those weakenings were found during an independent
verification pass, and the read-timeout test above was added because
that pass showed nothing yet proved the no-double-delivery claim.
```
uv run pytest tests/unit/connectors/openapi_plugin/ 200 passed in 5.60s
uv run ruff check semantic_kernel tests All checks passed! (ruff 0.9.6, the version .pre-commit-config.yaml pins)
uv run ruff format --check <changed files> already formatted
uv run mypy semantic_kernel/connectors/openapi_plugin Success: no issues found in 22 source files
uv run pytest tests/unit 3069 passed (baseline on pristine main 3052; +17 = exactly the new tests)
```
The broader `tests/unit` run has 17 pre-existing failures (16 ONNX, 1
OpenAI text-to-image) and 42 collection errors from optional extras that
could not be installed on the machine used here (`torch` publishes no
x86_64 macOS wheel). Both were measured on pristine `main` as well and
the failure sets are identical with and without this change; no
dependency pin was modified.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] I didn't break anyone 😄
Authored by Mycroft, the synthetic co-founder at Anton Dzyatkovsky's lab
(autonomous mode; named responsible person: Anton Dziatkovskii). The
test runs above were independently re-executed before submission.
---------
Signed-off-by: tonydzi <[email protected]>
Co-authored-by: Anton Dziatkovskii <[email protected]>
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
### Motivation and Context
### Description
- Improve PostgreSQL query construction for search filters.
- Expand unit and integration coverage for filtered searches.
- Clarify supported filter input in the connector documentation.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
## Summary
- Keep the first function when MCP tool names collide, warn for skipped
duplicates, and dispatch calls to the exact advertised function.
- Add opt-in plugin-qualified tool names and warn when names exceed
MCP's recommended length.
- Update MCP server documentation and cover naming, duplicate
registration, exclusions, dispatch, and agent forwarding with tests.
## Validation
- 70 focused MCP connector and agent tests passed.
- Ruff formatting passed; four changed Python files lint clean. The six
Ruff property-docstring findings in agent.py also occur at the upstream
base.
---------
Co-authored-by: Copilot App <[email protected]>
### Motivation and Context
Currently, the Python connectors for Google AI and Vertex AI don't pass
the standard semantic-kernel user agent string. This PR adds the user
agent header so that the Google API calls properly identify Semantic
Kernel.
This aligns with the dotnet implementation, and our (Google DeepMind's)
[best
practices](https://ai.google.dev/gemini-api/docs/partner-integration).
### Description
Sends the `User-Agent` header conditionally in `GoogleAIChatCompletion`,
`GoogleAITextCompletion`, and `GoogleAITextEmbedding`, matching the
OpenAI implementation as much as possible (gated behind telemetry flag,
using `SEMANTIC_KERNEL_USER_AGENT`).
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄.
## Summary
- update Transformers and related Hugging Face packages
- refresh Python dependencies used by the MCP OAuth demo
- regenerate the affected uv lockfiles
- adapt the Hugging Face text completion connector to Transformers 5
- temporarily disable live tests that depend on the retired Assistants
API
## Hugging Face connector
Transformers 5 removes the `text2text-generation`, `summarization` and
`translation` pipeline tasks, so `HuggingFaceTextCompletion` raised
`KeyError: Unknown task text2text-generation` on construction.
Those two tasks now use a small adapter built on `AutoModelForSeq2SeqLM`
and `AutoTokenizer` that preserves what the removed pipelines did:
- the same output keys (`summary_text` for summarization,
`generated_text` otherwise), so the content mapping is unchanged
- the model's task specific prefix (e.g. `summarize: `) is still
prepended before tokenization
- one record per generated sequence when `num_return_sequences > 1`
- `model_kwargs` are shared with the tokenizer load, as `pipeline()` did
- pipeline only options are dropped with a warning instead of reaching
`generate()`
`text-generation` keeps using `pipeline()`. There is no public API
change.
The previous unit tests mocked `pipeline()` and so did not catch the
incompatibility. New tests cover the adapter, option routing, device
placement, output mapping and prefix resolution.
## Temporarily disabled tests
The OpenAI and Azure OpenAI Assistants API has been retired. Live
requests now return HTTP 410 (`assistants_api_deprecated`) on Azure
OpenAI and HTTP 404 on OpenAI, so these tests cannot exercise a
functioning service.
- all 30 parametrized cases in
`tests/integration/agents/openai_assistant_agent/test_openai_assistant_agent_integration.py`
are skipped at module level, before the live-service fixture runs
- the `step1_openai_assistant` case in `tests/samples/test_concepts.py`
is skipped unconditionally
- the other concept samples are unchanged
- all 103 tests under `tests/unit/agents/openai_assistant` remain
enabled and passing
The skips are intentionally limited to live tests for the retired API.
Comments next to each skip include the migration guide and state that
the skip should be removed after the agents and sample move to the
replacement API.
## Validation
- uv lock consistency checks
- 35 Hugging Face unit tests pass
- all 12 deliberate connector mutations used to assess regression
coverage were detected by the unit tests
- all 103 Assistants agent unit tests pass
- 30 live Assistants integration cases and the one retired-API concept
sample report as skipped before making service requests
- the three text completion services used by the integration suite were
exercised against their real models on Transformers 5, for both
completion and streaming
- Ruff check and formatting pass
---------
Co-authored-by: Evan Mattson <[email protected]>
Co-authored-by: Copilot App <[email protected]>
Copilot-Session: c2d4dd29-0a9c-4f43-b2ce-243e19ec34b2
### Motivation and Context
The Copilot Studio agent exposed a `SERVICE` authentication mode that
was never reachable — it was guarded to always raise before its
implementation ran. Its dormant credential handling also triggered
certificate-related static analysis alerts.
### Description
Removes the service authentication path along with its settings,
parameters, tests, and documentation. `CopilotStudioAgentAuthMode` is
kept with its `INTERACTIVE` member, which is the only supported mode.
Interactive authentication is unchanged.
Service authentication can be reintroduced later as a complete, tested
feature.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
---------
Copilot-Session: 25dd6e2a-f759-4148-a630-40110e90eff2
### Motivation and Context
Bump Python version to 1.44.1 for a release
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump Python version to 1.44.1 for a release
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [X] I didn't break anyone 😄
### Motivation and Context
`_CopilotStudioAgentTokenFactory._cert_thumbprint` computes the X.509
certificate thumbprint that is passed to MSAL as the `thumbprint` client
credential. This value is the JWT `x5t` header, which MSAL and Microsoft
Entra ID require to be a SHA-1 digest - any other digest would be
rejected by the token endpoint.
Because it is a plain digest call, static analysis tooling flags it even
though the hash is used purely as a certificate identifier, not as a
cryptographic/security primitive (the call already passes
`usedforsecurity=False`).
### Description
Adds a comment explaining why SHA-1 is required here and annotates the
call so static analysis does not flag it. No behavior change.
Note: MSAL itself carries the same annotation on its own `x5t`
fingerprint computation.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
---------
Co-authored-by: Copilot App <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
Copilot-Session: d2b7d3e7-a125-4569-b976-a6534c1837ae
### Motivation and Context
MCP tool and prompt name normalization is many-to-one, so two remote
names can produce the same local name. The second registration silently
replaced the first.
### Description
Track normalized names already registered by the plugin and skip
colliding tools or prompts with a warning instead of overwriting.
Reloading the same remote item still refreshes it. Adds unit tests.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines
- [x] All unit tests pass, and I have added new tests where possible
---------
Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 4cab25f4-d987-42b3-bb34-e8d8a7185c80
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
Bumps the Python package version for the next release.
### Description
Updates `semantic_kernel.__version__` from `1.43.1` to `1.44.0`.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines and the
pre-submission formatting script raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I did not break anyone 😄
## Motivation and Context
The OpenAPI plugin imports operations from a spec and lets the host
restrict which operations are exposed via an
`OperationSelectionPredicate` (and via `OperationsToExclude`). Operation
selection and request-URL construction should share one canonical
interpretation of an operation path. This change closes two consistency
gaps where a spec-supplied path could be interpreted differently at
selection time than at request time.
1. **Selection vs. request path normalization.** The selection predicate
received the raw operation path, while the request URL is built from a
canonicalized path. An encoded dot-segment (for example `%2e%2e`) is
textually different from the endpoint it canonicalizes to, so it could
pass a path-based include/exclude filter yet resolve to a different
route. Operations whose path contains an encoded or literal dot-segment
are now excluded before the predicate is consulted, symmetric with the
existing request-time dot-segment rejection.
2. **Request target reconciliation (defense in depth).** After the
request URL is built, verify it did not move off the configured server.
An operation path that is an absolute or authority-changing URI (for
example `https://another-host/admin`) carries no dot-segment, so it
passes path-segment validation, yet `System.Uri` / `urljoin` resolve it
to a different scheme, host, or port. Such a request is now rejected
before it is sent, so a credential-bearing request cannot be redirected
to an unintended target.
Both changes are applied symmetrically to the .NET and Python OpenAPI
ports.
## Description
- **.NET**
- `OpenApiDocumentParser` skips operations whose path contains a
dot-segment before invoking the selection predicate.
- `RestApiOperation` extracts a shared `ContainsDotSegment` helper
(reused by the existing `ValidatePathSegments`) and, after building the
request URL, reconciles its scheme/host/port and base path against the
configured server.
- **Python**
- `openapi_parser` skips dot-segment operations before the predicate
runs.
- `rest_api_operation` adds a shared `_contains_dot_segment` helper and
a post-construction `_ensure_request_target_matches_server`
reconciliation.
## Tests
- .NET: added selection-exclusion and request-target reconciliation
tests; full `Functions.UnitTests` OpenApi suite green (488).
- Python: added parity tests for both behaviors;
`tests/unit/connectors/openapi_plugin` green (173), ruff + ruff-format +
mypy + pre-commit clean.
## Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines
- [x] All unit tests pass, and I have added new tests where possible
### Motivation and Context
The MCP server created by `create_mcp_server_from_kernel` (and the
`Kernel.as_mcp_server` wrapper) accepts an `excluded_functions` argument
to keep selected kernel functions off the server. Previously this list
was applied only when building the tool set advertised by the
`list_tools` handler; the `call_tool` handler did not consult it and
forwarded the client-supplied name straight to the kernel. As a result
the set of advertised tools and the set of callable tools could diverge.
### Description
- Derive a single `exposed_names` set from `functions_to_expose` and
check it in the `call_tool` handler, returning a `METHOD_NOT_FOUND`
error for any name that is not exposed.
- Remove a leftover `print` debug statement in `_call_kernel_function`.
- Add a unit test covering the `call_tool` behavior for a non-exposed
function.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines
- [x] All unit tests pass, and I have added new tests where possible
---------
Co-authored-by: Copilot <[email protected]>
## Summary
- Add server URL validation for Python OpenAPI operation execution
before outbound requests are made
- Add execution settings for trusted allowed base URLs and
private-network access
- Pass operation arguments into server variable resolution and add
regression coverage for substituted server hosts
## Testing
- `uv run pytest
tests/unit/connectors/openapi_plugin/test_server_url_validator.py
tests/unit/connectors/openapi_plugin/test_openapi_runner.py
tests/unit/connectors/openapi_plugin/test_openapi_manager.py
tests/unit/connectors/openapi_plugin/test_sk_openapi.py`
- `uv run pytest tests/integration/cross_language/test_cross_language.py
-k openapi`
- `uv run ruff check ...`
- `uv run ruff format --check ...`
---------
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Bump Python version to 1.43.1 for a release.
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump Python version to 1.43.1 for a release.
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [X] I didn't break anyone 😄
## Motivation and Context
Closes#14085.
The .NET and Python OpenAPI plugins select operations using the raw
OpenAPI path, but build the runtime request URL from a canonicalized
path. Encoded dot-segments such as `/resources/%2e%2e/admin` pass an
`OperationSelectionPredicate` path check, yet `System.Uri` (.NET) and
`urljoin` (Python) collapse them to a different route at request time.
The selected path and the actual request target can therefore diverge.
## Description
- **.NET** (`RestApiOperation.ValidatePathSegments`): decodes each path
segment until stable (handling double encoding like `%252e` and encoded
separators `%2f`/`%5c`) before rejecting canonical `.` or `..` segments.
- **Python** (`RestApiOperation.build_path`): adds equivalent
decode-then-reject validation before the URL is built.
Regression tests on both stacks cover literal and encoded dot-segments,
mixed case, encoded slashes, and double encoding, plus negative tests
confirming legitimate encoded characters still work.
Test results:
- .NET: 482/482 `Functions.UnitTests` OpenApi tests pass.
- Python: 109/109 `openapi_plugin` unit tests pass.
## Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
### Description
Adds `function_choice_behavior` parameter to Azure AI and OpenAI
Assistant agents, aligning them with the existing Responses agent and
Chat Completion agent APIs.
### Changes
- Add `function_choice_behavior` parameter to
`invoke`/`invoke_stream`/`get_response` on both `AzureAIAgent` and
`OpenAIAssistantAgent` public APIs
- Add `function_choice_behavior` parameter to internal
`AzureAIAgentThreadActions` and `AssistantThreadActions`
`invoke`/`invoke_stream` methods
- Support `tools` parameter override for SDK-level tools
(CodeInterpreter, FileSearch, etc.)
- Filter kernel functions based on `FunctionChoiceBehavior`
configuration
- Validate that only `Auto` type with auto-invoke enabled is supported
- Fix `_get_tools` in OpenAI path to use passed `kernel` parameter
instead of `agent.kernel`
- Add comprehensive unit tests for both thread actions and public agent
APIs
---------
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Bump Python package version to 1.43.0 for a release
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump Python package version to 1.43.0 for a release
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
Update OpenAPI document parsing to gate file and HTTP ref resolution
separately.
### Breaking change
- `RESOLVE_FILES` is no longer enabled by default. Only internal JSON
pointer references are resolved by default.
- Users with multi-file OpenAPI specs must now pass
`enable_file_ref_resolution=True` via
`OpenAPIFunctionExecutionParameters`.
- `enable_external_ref_resolution` has been renamed to
`enable_http_ref_resolution`.
---------
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Bump Python pkg version to 1.42.0 for a release.
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump Python pkg version to 1.42.0 for a release.
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [X] I didn't break anyone 😄
### Motivation and Context
Improvements for MCP tool calls by adding an optional sampling callback.
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Improvements for MCP tool calls by adding an optional sampling callback.
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
---------
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
CI fails with `AttributeError: 'SearchIndexClient' object has no
attribute '_endpoint'` when `azure-search-documents` resolves to 12.0.0
(released 2026-04-01). The 12.0.0 release migrated from AutoRest to
TypeSpec code generation, removing private attributes `_endpoint` and
`_credential` from `SearchIndexClient`.
CI uses `uv sync -U` which upgrades past the lockfile, pulling in 12.0.0
since `pyproject.toml` specifies `>= 11.6.0b4` with no upper bound.
### Description
Stop reading `SearchIndexClient._endpoint` and `._credential`. Instead,
store endpoint and credential as explicit fields on `AzureAISearchStore`
and `AzureAISearchCollection`, and pass them directly when constructing
`SearchClient`.
**Changes:**
- `_get_search_client()` accepts explicit `endpoint` + `credential`
params instead of extracting from `SearchIndexClient` private attrs
- `_resolve_credential()` new helper extracted from
`_get_search_index_client()` for reuse
- `AzureAISearchStore` / `AzureAISearchCollection` store
`search_endpoint` and `search_credential` as fields, thread them through
construction
- Tests updated to assert on public fields instead of private SDK
attributes
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] All unit tests pass with both `azure-search-documents==11.7.0b2`
and `==12.0.0`
- [x] No breaking changes to public API
---------
Co-authored-by: Copilot <[email protected]>
Apply `urllib.parse.quote(safe='')` to path parameter values before
substitution in `build_path()`, consistent with the .NET implementation
which uses `HttpUtility.UrlEncode`.
### Changes
- `rest_api_operation.py`: encode path parameter values per RFC 3986
- `test_sk_openapi.py`: add tests for encoded path parameters
- `pyproject.toml` / `uv.lock`: pin `azure-search-documents >= 11.6.0b4,
< 12.0.0`
### Pin azure-search-documents < 12.0.0
Version 12.0.0 removed the internal `_endpoint` attribute from
`SearchIndexClient`, which breaks `AzureAISearchCollection`
initialization at `azure_ai_search.py:158`. Pinning to `< 12.0.0` until
the code is updated to use the new public API.
### Tests
All existing and new `build_path` tests pass.
---------
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Bump package version to 1.41.3 for a release
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump package version to 1.41.3 for a release
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
## Summary
- Minor defense-in-depth hardening for `InMemoryCollection` filter
parsing.
- Extends the internal dunder attribute blocklist and adds a regression
test covering the blocked set.
## Test plan
- [x] `uv run pytest tests/unit/connectors/memory/test_in_memory.py`
### Motivation and Context
bump py version to 1.41.2 for a release
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
bump py version to 1.41.2 for a release
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [X] I didn't break anyone 😄
### Motivation and Context
This PR updates the Jinja2 and Handlebars prompt-template helpers to
serialize chat messages through the existing XML/message serializer
instead of assembling message XML manually. It also aligns the
prompt-template samples with the serializer-backed helper and adds
regression coverage for common message content.
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Prompt template message serialize improvements.
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
---------
Co-authored-by: MAF Dashboard Bot <[email protected]>
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Bump Pythong version to 1.41.1 for a release
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump Pythong version to 1.41.1 for a release
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [X] I didn't break anyone 😄
### Motivation and Context
Closes#12442
When `ChatCompletionAgent` instances are used as plugins with
`GoogleAIChatCompletion`, the application crashes with:
```
ValueError: Unknown field for Schema: anyOf
```
**Root cause**: The Semantic Kernel JSON schema builder generates
`anyOf` for Union types (e.g. `str | list[str]` on the agent's
`messages` parameter) and type-as-array for Optional types (e.g.
`["string", "null"]`). Google AI's protobuf `Schema` does not support
these constructs.
### Description
Add `sanitize_schema_for_google_ai()` to `shared_utils.py` that
recursively rewrites unsupported schema constructs:
- `anyOf` / `oneOf` with a null variant → single type + `nullable: true`
- `anyOf` / `oneOf` without null → picks the first variant
- `type` as array (e.g. `["string", "null"]`) → single type + `nullable:
true`
Applied in both
`kernel_function_metadata_to_google_ai_function_call_format()` and
`kernel_function_metadata_to_vertex_ai_function_call_format()`.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] The existing tests pass, and I have added 12 new regression tests
- [x] I didn't break any existing functionality
> [!NOTE]
> AI-assisted contribution: Claude helped with code review, test
generation, and formatting.
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Evan Mattson <[email protected]>
## Summary
Fixes#13483
### Motivation and Context
When `use_vertexai=True`, users authenticate via Application Default
Credentials (ADC) and don't need an API key. However, the initialization
check for `api_key` runs unconditionally, blocking Vertex AI users with:
```
ServiceInitializationError: The API key is required when use_vertexai is False.
```
### Description
Guard the `api_key` validation with `not
google_ai_settings.use_vertexai` in all three Google AI service classes:
- `GoogleAIChatCompletion`
- `GoogleAITextCompletion`
- `GoogleAITextEmbedding`
The error message already reads *"when use_vertexai is False"*, so the
condition now matches the intent.
### Before / After
```python
# Before — fails even with use_vertexai=True
GoogleAIChatCompletion(
use_vertexai=True,
cloud_project_id="my-project",
cloud_region="us-central1"
)
# → ServiceInitializationError: The API key is required when use_vertexai is False.
# After — works correctly
GoogleAIChatCompletion(
use_vertexai=True,
cloud_project_id="my-project",
cloud_region="us-central1"
)
# → Initializes successfully, uses ADC for authentication
```
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] The code follows the [SK coding
standards](https://github.com/microsoft/semantic-kernel/blob/main/python/README.md)
---------
Co-authored-by: giulio-leone <[email protected]>
Co-authored-by: giulio-leone <[email protected]>
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Follow-up to #13499. The previous PR added the `allowed_module_prefixes`
parameter but defaulted it to `None`, which meant the module restriction
was only active if developers discovered and configured it.
Secure-by-default is the right posture here — restrict first, let
developers widen as needed.
- Change `allowed_module_prefixes` default from `None` to
`("semantic_kernel.",)` across Dapr runtime step loading
- Non-SK step classes now require developers to explicitly add their
module prefix (e.g. `("semantic_kernel.", "myapp.steps.")`)
- Developers can pass `None` to opt out entirely, but the secure default
is now enforced
- The Dapr runtime code is experimental, so this is a non-breaking
change per our stability guarantees
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
---------
Co-authored-by: MAF Dashboard Bot <[email protected]>
Co-authored-by: Copilot <[email protected]>
## Summary
Fixes#12708
`ChatHistoryTruncationReducer.reduce()` can orphan `TOOL` role messages
by truncating the preceding `assistant` message that contains the
`tool_calls`, causing OpenAI to reject the history with:
```
messages with role 'tool' must be a response to a preceding message with 'tool_calls'
```
## Root Cause
`locate_safe_reduction_index()` uses
`contains_function_call_or_result()` to detect tool-related messages
during its backward scan. This function only checks `msg.items` for
`FunctionCallContent`/`FunctionResultContent` instances.
However, `TOOL` role messages can contain only text content (no
`FunctionResultContent` in `items`), which causes the backward scan to
treat them as regular messages. The truncation point then lands between
the `tool_calls` assistant message and its `TOOL` responses, orphaning
the tool results.
## Fix
Added `AuthorRole.TOOL` check to `contains_function_call_or_result()`:
```python
if msg.role == AuthorRole.TOOL:
return True
```
This ensures **any** `TOOL` role message is recognized as part of a tool
call/result pair, regardless of whether it has `FunctionResultContent`
in its `items`.
## Test
Added
`test_locate_safe_reduction_index_tool_role_without_function_result_content`
that verifies TOOL role messages with only text content are not
separated from their tool call.
---------
Co-authored-by: giulio-leone <[email protected]>
Co-authored-by: Evan Mattson <[email protected]>
Co-authored-by: Copilot <[email protected]>
## Summary
`ChatHistoryTruncationReducer.reduce()` silently deletes
system/developer messages when truncating chat history. This is because
it calls `extract_range()`, which unconditionally filters out
system/developer messages — a function designed for the summarization
use case, not truncation.
Fixes#12612.
## Approach
Port the .NET SDK fix (PR #10344) to Python:
1. Detect the first system/developer message before truncation
2. Pass `has_system_message=True` to `locate_safe_reduction_index` so
`target_count` accounts for the preserved message (matches .NET's
`targetCount -= hasSystemMessage ? 1 : 0`)
3. Use a simple `history[truncation_index:]` slice instead of
`extract_range` (which strips system messages)
4. Prepend the system message if it was truncated away
Also adds a guard for `target_count <= 0` after the system message
adjustment to prevent `IndexError` when `target_count=1`.
## Changes
| File | Change |
|------|--------|
| `chat_history_reducer_utils.py` | Add `has_system_message` parameter,
adjust `target_count`, guard against `<= 0` |
| `chat_history_truncation_reducer.py` | Detect system message, bypass
`extract_range`, prepend if truncated |
| `test_chat_history_truncation_reducer.py` | Update 2 existing tests +
4 new tests (system, developer, no-system, target_count=1) |
## Note
The summarization reducer (`ChatHistorySummarizationReducer`) has the
same bug — it also uses `extract_range` and loses system messages during
summarization. The .NET summarization reducer preserves system messages
via `AssemblySummarizedHistory`. This should be addressed in a follow-up
PR to keep this change focused.
## Test plan
- [x] 11/11 truncation reducer tests pass (was 7, now 11)
- [x] 9/9 utils tests pass (no regressions from new parameter)
- [x] 11/11 summarization reducer tests pass (unaffected)
- [x] Reproduces and fixes the exact scenario from #12612
- [x] Edge case: `target_count=1` with system message does not crash
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Evan Mattson <[email protected]>
### Motivation and Context
Fixes#13632
When a prompt contains HTML tags such as `<p>`, `<div>`, `<b>`, etc.,
the
`ChatHistory.from_rendered_prompt()` method wraps the rendered prompt in
a
`<root>` element and parses it as XML. Any child elements whose tag
names do
not match the known SK template tags (`message`, `chat_history`) were
silently
skipped, causing their text content to be lost. This meant a prompt
like:
```
Translate: "<p>What is your name?</p>"
```
would arrive at the LLM as an empty message, because `<p>What is your
name?</p>`
was discarded during XML traversal.
### Description
In `ChatHistory.from_rendered_prompt`, when an XML child element has an
unrecognized tag (i.e. it is not `message` or `chat_history`), the
element
is now serialized back to its original text representation and appended
to
the preceding message content. The element's tail text is likewise kept
in
the same message, preserving the full original prompt text.
**Changed files:**
- `python/semantic_kernel/contents/chat_history.py` -- handle unknown
XML
tags as literal text in `from_rendered_prompt()`
- `python/tests/unit/contents/test_chat_history.py` -- added four
regression
tests covering HTML `<p>`, multiple HTML tags, HTML surrounded by text,
and SK tags mixed with HTML
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] The existing tests pass and new tests have been added
- [x] I didn't break any existing functionality
---------
Co-authored-by: Evan Mattson <[email protected]>
### Motivation and Context
Fixes#13480
When using Gemini models (2.5 Pro / 3 Pro) with thinking enabled, the
API returns a `thought_signature` on function call `Part` objects. Per
[Google's Thought Signatures
documentation](https://ai.google.dev/gemini-api/docs/thought-signatures),
this signature **must** be included in subsequent requests. Without it,
follow-up turns with tool results fail with:
```
HTTP 400: Function call is missing a thought_signature in functionCall parts
```
The .NET connector was already fixed in #13418. This PR applies the
equivalent fix to the Python connector.
### Description
**Response parsing** (capture `thought_signature`):
- `google_ai_chat_completion.py`: When creating `FunctionCallContent`
from response parts, capture `part.thought_signature` into
`FunctionCallContent.metadata` (both non-streaming and streaming paths)
- `vertex_ai_chat_completion.py`: Same capture via
`part_dict.get("thought_signature")` for Vertex AI
**Request building** (restore `thought_signature`):
- `google_ai/services/utils.py`: In `format_assistant_message()`, when a
`FunctionCallContent` has `thought_signature` in its metadata, construct
the `Part` directly with the `thought_signature` parameter instead of
using `Part.from_function_call()`
- `vertex_ai/services/utils.py`: In `format_assistant_message()`,
include `thought_signature` in the `Part.from_dict()` dictionary when
present
**Backward compatible**: When `thought_signature` is not present
(thinking disabled or older models), behavior is identical to before.
### Test Coverage
Added 4 new tests:
- `test_format_assistant_message_with_thought_signature` (Google AI) —
verifies round-trip preservation
- `test_format_assistant_message_without_thought_signature` (Google AI)
— verifies backward compatibility
- `test_format_assistant_message_with_thought_signature` (Vertex AI) —
verifies round-trip preservation
- `test_format_assistant_message_without_thought_signature` (Vertex AI)
— verifies backward compatibility
All 110 existing Google connector tests continue to pass.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] All unit tests pass, and I have added new tests
- [x] I didn't break anyone 😄
---------
Co-authored-by: giulio-leone <[email protected]>
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Bump Python version to 1.41.0 for a release
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump Python version to 1.41.0 for a release
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
Dall-e-3 and Dall-e-2 have been deprecated. The newer gpt-1-image model
returns base64 strings.
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
Return url if set, otherwise return the base64 string.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
---------
Co-authored-by: Evan Mattson <[email protected]>
Eduard van Valkenburg