mirror of
https://github.com/microsoft/semantic-kernel.git
synced 2026-10-12 02:19:06 +00:00
64005c77870a3b8a157f8aefefd45093f1e6fc00
5098
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Evan Mattson
|
7d885ddac1 |
Consolidate Python and .NET dependency updates (#14222)
### Motivation and Context Consolidates the currently open Python and .NET Dependabot updates into one coordinated dependency change. This reduces duplicate review and CI work while preserving each source PR's update intent. The npm and Yarn updates are intentionally excluded from this draft and remain in their original Dependabot PRs. ### Related Issue Supersedes: - https://github.com/microsoft/semantic-kernel/pull/14178 - https://github.com/microsoft/semantic-kernel/pull/14184 - https://github.com/microsoft/semantic-kernel/pull/14185 - https://github.com/microsoft/semantic-kernel/pull/14186 - https://github.com/microsoft/semantic-kernel/pull/14187 - https://github.com/microsoft/semantic-kernel/pull/14188 - https://github.com/microsoft/semantic-kernel/pull/14189 - https://github.com/microsoft/semantic-kernel/pull/14191 - https://github.com/microsoft/semantic-kernel/pull/14192 - https://github.com/microsoft/semantic-kernel/pull/14202 - https://github.com/microsoft/semantic-kernel/pull/14203 - https://github.com/microsoft/semantic-kernel/pull/14204 - https://github.com/microsoft/semantic-kernel/pull/14205 - https://github.com/microsoft/semantic-kernel/pull/14207 - https://github.com/microsoft/semantic-kernel/pull/14208 - https://github.com/microsoft/semantic-kernel/pull/14211 - https://github.com/microsoft/semantic-kernel/pull/14212 - https://github.com/microsoft/semantic-kernel/pull/14213 - https://github.com/microsoft/semantic-kernel/pull/14214 - https://github.com/microsoft/semantic-kernel/pull/14215 - https://github.com/microsoft/semantic-kernel/pull/14216 - https://github.com/microsoft/semantic-kernel/pull/14217 - https://github.com/microsoft/semantic-kernel/pull/14218 - https://github.com/microsoft/semantic-kernel/pull/14219 - https://github.com/microsoft/semantic-kernel/pull/14221 ### Description - Updates the selected .NET Aspire and AWS SDK package versions in central package management. - Updates the selected Python requirements and regenerates both affected uv lockfiles without losing earlier bumps. - Keeps the compatible ONNX Runtime/GenAI pair on Python 3.10 while applying ONNX Runtime GenAI 0.14.1 on Python 3.11 and newer. - Retains pyOpenSSL 26.2.0, which is newer than the 26.0.0 requested by its source PR and is required by the consolidated cryptography update. - Uses Pinecone 7.3 or newer on Windows, where Pinecone 7.0.1 imports the unavailable Unix `readline` module, while retaining the existing `~=7.0` range on macOS and Linux. - Constrains MCP to the compatible 1.x API because the current Semantic Kernel integration imports interfaces removed by MCP 2.0. ### Validation - Python unit tests passed across Python 3.10-3.13 on Ubuntu, Windows, and macOS, including Dapr jobs. - Python pre-commit, lock validation, spell checking, and integration-test aggregate checks passed. - .NET 9/10 builds, package-install checks, unit tests, AOT tests, formatting, and coverage checks passed on Ubuntu and Windows. - Merge Gatekeeper passed. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 |
||
|
SergeyMenshykh
|
3da48a3d01 |
Python: [Breaking] Add MCP tool approval callback for Azure AI Agent (#14210)
## Summary - Add an Azure AI Agent callback for MCP tool approval requests. - Route MCP tool approval submissions through a shared helper in thread actions. - Add unit coverage for approval, denial, callback failures, and per-call decisions. ## Testing - python -m pytest tests/unit/agents/azure_ai_agent --------- Copilot-Session: 3e190979-228b-4a82-8e63-5ad14bd4879f |
||
|
SergeyMenshykhandCopilot App
|
e78a8f503b |
Suppress CodeQL false positive in internal HTTP utility (#14223)
Adds an inline CodeQL suppression comment for a confirmed false positive in an internal HTTP utility method. Input validation is handled by callers higher in the stack. Co-authored-by: Copilot App <[email protected]> Copilot-Session: 5830be01-63d3-41f6-ae70-8ffeae81d46f |
||
|
SergeyMenshykhandCopilot App
|
441ac99479 |
Update Microsoft.AspNetCore.OData to 9.5.0 (#14224)
Pin `Microsoft.AspNetCore.OData` to version 9.5.0 in `Directory.Packages.props`. This overrides the transitive dependency brought in by `OData2Linq 2.2.0` used in the Entity Framework structured data plugin. Co-authored-by: Copilot App <[email protected]> Copilot-Session: a8efdd59-6d18-4194-8561-1d4144f87333 |
||
|
SergeyMenshykh
|
01e74b054a |
.NET: Harden dotnet-format workflow shell handling (#14201)
Minor robustness and hygiene improvements to how the dotnet-format workflow passes values to the shell. No functional change to the formatting behavior. --------- Copilot-Session: b0794c00-ed83-4259-8d12-26df4b836393 |
||
|
westey
|
7481cd062b |
Fix cosmosdb vectorstore bug (#14182)
### Motivation and Context <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
CopilotandAdam Sitnik
|
61a6b0c5fa |
Migrate VectorStoreRAG and Concepts samples to CommunityToolkit.VectorData packages (#14170)
### Motivation and Context `Microsoft.SemanticKernel.Connectors.*` vector store packages are moving to `CommunityToolkit.VectorData.*`. This updates the `VectorStoreRAG` and `Concepts` sample projects to reference the new package IDs and namespaces. ### Description **Package reference updates** (`Directory.Packages.props`, `VectorStoreRAG.csproj`, `Concepts.csproj`): | Old | New | Version | |-----|-----|---------| | `Microsoft.SemanticKernel.Connectors.AzureAISearch` | `CommunityToolkit.VectorData.AzureAISearch` | 1.0.0 | | `Microsoft.SemanticKernel.Connectors.CosmosMongoDB` | `CommunityToolkit.VectorData.CosmosMongoDB` | 1.0.0 | | `Microsoft.SemanticKernel.Connectors.CosmosNoSql` | `CommunityToolkit.VectorData.CosmosNoSql` | 1.0.0 | | `Microsoft.SemanticKernel.Connectors.InMemory` | `CommunityToolkit.VectorData.InMemory` | 1.0.0 | | `Microsoft.SemanticKernel.Connectors.PgVector` | `CommunityToolkit.VectorData.PgVector` | 1.0.0 | | `Microsoft.SemanticKernel.Connectors.Qdrant` | `CommunityToolkit.VectorData.Qdrant` | 1.0.0 | | `Microsoft.SemanticKernel.Connectors.Redis` | `CommunityToolkit.VectorData.Redis` | 1.0.0 | | `Microsoft.SemanticKernel.Connectors.Weaviate` | `CommunityToolkit.VectorData.Weaviate` | 1.0.0 | **Namespace updates** : ```csharp // Before using Microsoft.SemanticKernel.Connectors.InMemory; // After using CommunityToolkit.VectorData.InMemory; ``` DI extension methods (`AddInMemoryVectorStore`, `AddQdrantCollection`, etc.) moved to `Microsoft.Extensions.DependencyInjection` in the CT packages — all affected files already had that `using`, so no additional changes needed there. **API compatibility fixes:** - `[VectorStoreVector(Dimensions: N)]` → `[VectorStoreVector(N)]` in two files — the new `Microsoft.Extensions.VectorData.Abstractions` constructor uses a positional parameter named `dimensions` (lowercase), so the old named-argument form no longer compiles. - `SharpCompress` pin bumped `0.48.0` → `0.48.1` in `Directory.Packages.props` — `CommunityToolkit.VectorData.CosmosMongoDB` pulls `MongoDB.Driver 3.10.0` which requires `>= 0.48.1`. - Added `<AzureCosmosDisableNewtonsoftJsonCheck>true</AzureCosmosDisableNewtonsoftJsonCheck>` to both sample csproj files — `CommunityToolkit.VectorData.CosmosNoSql` pulls `Microsoft.Azure.Cosmos 3.61.0` which added a mandatory Newtonsoft.Json explicit-reference check not present in the prior version. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: Adam Sitnik <[email protected]> |
||
|
|
d003eb2590 |
Consolidate Dependabot dependency updates (#14176)
### Motivation and Context Semantic Kernel currently has 43 open Dependabot pull requests spanning GitHub Actions, .NET, Python, npm, and Yarn dependency graphs. This rollup applies their compatible net changes together on the latest `main`, making it possible to validate and merge the updates as one coherent dependency state. Supersedes: - https://github.com/microsoft/semantic-kernel/pull/13133 - https://github.com/microsoft/semantic-kernel/pull/13134 - https://github.com/microsoft/semantic-kernel/pull/13136 - https://github.com/microsoft/semantic-kernel/pull/13172 - https://github.com/microsoft/semantic-kernel/pull/13507 - https://github.com/microsoft/semantic-kernel/pull/13601 - https://github.com/microsoft/semantic-kernel/pull/13606 - https://github.com/microsoft/semantic-kernel/pull/13666 - https://github.com/microsoft/semantic-kernel/pull/13673 - https://github.com/microsoft/semantic-kernel/pull/13688 - https://github.com/microsoft/semantic-kernel/pull/13700 - https://github.com/microsoft/semantic-kernel/pull/13707 - https://github.com/microsoft/semantic-kernel/pull/13708 - https://github.com/microsoft/semantic-kernel/pull/13712 - https://github.com/microsoft/semantic-kernel/pull/13721 - https://github.com/microsoft/semantic-kernel/pull/13873 - https://github.com/microsoft/semantic-kernel/pull/13930 - https://github.com/microsoft/semantic-kernel/pull/13939 - https://github.com/microsoft/semantic-kernel/pull/13949 - https://github.com/microsoft/semantic-kernel/pull/13950 - https://github.com/microsoft/semantic-kernel/pull/13951 - https://github.com/microsoft/semantic-kernel/pull/13997 - https://github.com/microsoft/semantic-kernel/pull/14000 - https://github.com/microsoft/semantic-kernel/pull/14053 - https://github.com/microsoft/semantic-kernel/pull/14069 - https://github.com/microsoft/semantic-kernel/pull/14088 - https://github.com/microsoft/semantic-kernel/pull/14091 - https://github.com/microsoft/semantic-kernel/pull/14094 - https://github.com/microsoft/semantic-kernel/pull/14103 - https://github.com/microsoft/semantic-kernel/pull/14106 - https://github.com/microsoft/semantic-kernel/pull/14107 - https://github.com/microsoft/semantic-kernel/pull/14108 - https://github.com/microsoft/semantic-kernel/pull/14109 - https://github.com/microsoft/semantic-kernel/pull/14110 - https://github.com/microsoft/semantic-kernel/pull/14128 - https://github.com/microsoft/semantic-kernel/pull/14148 - https://github.com/microsoft/semantic-kernel/pull/14149 - https://github.com/microsoft/semantic-kernel/pull/14160 - https://github.com/microsoft/semantic-kernel/pull/14161 - https://github.com/microsoft/semantic-kernel/pull/14164 - https://github.com/microsoft/semantic-kernel/pull/14171 - https://github.com/microsoft/semantic-kernel/pull/14172 - https://github.com/microsoft/semantic-kernel/pull/14173 ### Description - Updates the requested GitHub Actions and preserves the PR-file-scoped typos workflow fix. - Consolidates the .NET Aspire, AWS SDK, ReportGenerator, JavaScript, and SQLite security updates. - Regenerates the npm, Yarn, and uv lockfiles from the combined manifests instead of resolving generated-file conflicts by selection. - Rolls overlapping updates forward to one compatible result: pyasn1 0.6.4 supersedes 0.6.3; pyOpenSSL 26.2.0 remains compatible with cryptography 48.0.1; and Vite 8/Rolldown makes the older Rollup-only overrides obsolete. - Retains updates already present on current `main` without reintroducing stale pins, including Aspire Hosting Azure Search 13.3.0 and Prompty.Core 2.0.0-beta.3. The full .NET solution builds in Debug with zero warnings and errors. Focused validation passed 82 .NET tests (3 skipped), 1,096 Python tests, both frontend production builds, and uv lock consistency checks for the main Python project and OAuth sample. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> |
||
|
|
acb3e35c54 |
.Net: [.NET] Add TimeProvider injection to TimePlugin for deterministic testing (#14112)
Closes #14111 ## Summary - Adds a `TimeProvider` constructor parameter to `TimePlugin` (defaults to `TimeProvider.System`, so all existing callers are unaffected) - Replaces all direct `DateTimeOffset.Now` / `DateTimeOffset.UtcNow` calls with `_timeProvider.GetLocalNow()` / `_timeProvider.GetUtcNow()` - Rewrites `TimePluginTests` from 5 real-clock tests to 26 deterministic tests covering every public method, using an inline `FixedUtcTimeProvider` subclass (no new test dependencies) ## Key decisions | Decision | Reason | |---|---| | `System.TimeProvider` (not a custom `IClock`) | Standard .NET 8+ pattern; no extra abstraction needed | | Inline `FixedUtcTimeProvider` subclass in tests | Avoids adding `Microsoft.Extensions.TimeProvider.Testing` as a new dependency; 3-line subclass is clearer | | `LocalTimeZone = TimeZoneInfo.Utc` on the test provider | Makes test output identical on any machine regardless of OS timezone | | Default `TimeProvider.System` in constructor | Zero breaking change — all existing callers (`new TimePlugin()`) work unchanged | ## Test results ``` Passed! - Failed: 0, Passed: 394, Skipped: 0, Total: 394 ``` --------- Co-authored-by: Claude Sonnet 4.6 <[email protected]> Co-authored-by: westey <[email protected]> |
||
|
King StarandRoger Barreto
|
e15ae168f6 |
.Net: Reject mixed-separator UNC paths in file plugins (#14166)
### Motivation and Context `FileIOPlugin` and `WebFileDownloadPlugin` rejected only some UNC path prefixes before path canonicalization. On Windows, mixed `/\` and `\/` prefixes resolve to UNC paths too, so those forms could reach filesystem path resolution before the allow-list rejected them. Fixes #14157. ### Description - Treat any two leading `/` or `\` characters as a UNC or extended-path prefix in both plugins. - Reject those paths before canonicalization, `File.Exists`, or `File.GetAttributes` can probe the filesystem. - Add read, write, and download regressions for all four separator combinations. The change is limited to the two plugins named in the issue. Single-separator rooted paths, normal local paths, allow-list behavior, symlink handling, overwrite checks, and download limits are unchanged. ### Verification ```bash dotnet test dotnet/src/Plugins/Plugins.UnitTests/Plugins.UnitTests.csproj --filter "FullyQualifiedName~ItRejectsUncOrExtendedPathsOnReadAsync|FullyQualifiedName~ItRejectsUncOrExtendedPathsOnWriteAsync|FullyQualifiedName~DownloadToFileRejectsUncOrExtendedPathsAsync" dotnet test dotnet/src/Plugins/Plugins.UnitTests/Plugins.UnitTests.csproj --filter "FullyQualifiedName~FileIOPluginTests" dotnet test dotnet/src/Plugins/Plugins.UnitTests/Plugins.UnitTests.csproj --filter "FullyQualifiedName!~DownloadToFileSucceedsAsync&FullyQualifiedName!~DownloadToFileFailsForInvalidParametersAsync" dotnet format dotnet/src/Plugins/Plugins.UnitTests/Plugins.UnitTests.csproj --verify-no-changes --no-restore ``` The focused regressions pass 12/12, all `FileIOPluginTests` pass 21/21, and the deterministic Plugins unit-test suite passes 409/409. The two excluded Web tests use a live HTTPS request and fail on unmodified `main` in this macOS environment because certificate revocation status is unavailable. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible (409 deterministic tests pass; two live-network baseline tests are environment-limited as noted above) - [x] I didn't break anyone 😄 --------- Signed-off-by: King Star <[email protected]> Co-authored-by: Roger Barreto <[email protected]> |
||
|
Roger Barreto
|
33a3e555e9 |
.Net: [BREAKING] Upgrade Prompty.Core to 2.0.0-beta.3 to resolve NU1903 vulnerability (#14169)
## Motivation and Context CI (`dotnet-build-and-test`) currently fails repo-wide on **NU1903**: `Prompty.Core` `0.2.3-beta` has a known high severity advisory [GHSA-wxhm-2mq7-7697](https://github.com/advisories/GHSA-wxhm-2mq7-7697) (path traversal in `${file:...}` reference expansion). The build treats the audit as an error (`--warnaserror`), so this blocks every .NET PR. The advisory is fixed in `Prompty.Core` **2.0.0-beta.2+**. That release is a significant rewrite: it targets **net9.0 only** and ships a new `.prompty` spec and API. There is no intermediate 0.x fix, so resolving the advisory requires this upgrade. ## Description Upgrades `Prompty.Core` `0.2.3-beta` → `2.0.0-beta.3` and adapts Semantic Kernel to the 2.0 surface. - **Package**: bump `Prompty.Core` in `Directory.Packages.props`; remove the `Scriban` workaround reference (2.0 no longer depends on it). - **Target frameworks**: retarget `Functions.Prompty` to `net10.0` only. The fixed package is net9.0-only, so `net8.0` and `netstandard2.0` can no longer be supported. - **Loader migration** (`KernelFunctionPrompty`): - Text input: `FrontmatterParser.Parse` + `Prompty.Load`. - File input: secure `PromptyLoader.Load` with `AllowedFileRoots` scoped to the prompty file's directory, so `${file:...}` references are confined (the fix for the advisory). - Parse failures are normalized to `ArgumentException` to preserve the input-validation contract. - **Test data + tests**: migrate the `.prompty` files to the 2.0 spec (`apiType`, list-form `inputs`, renamed `options`) and update `PromptyTests` accordingly. - **Samples**: update the `Concepts` inline templates to the 2.0 spec. ## ⚠️ Breaking changes `Microsoft.SemanticKernel.Prompty` is a preview (`-beta`) package. This change: - **Drops `net8.0` and `netstandard2.0`** support (now `net10.0` only). - Requires `.prompty` files to use the **2.0 spec** (`model.apiType`, `model.provider`, `connection.kind`, `inputs`/`outputs` as lists, renamed `model.options`). v1 files are not auto-migrated. See the [Prompty v1→v2 migration guide](https://www.prompty.ai/migration/). - No longer surfaces the following, which are not part of the 2.0 model: input/output `json_schema`, connection `service_id`, and arbitrary `model.options` passthrough beyond the strongly typed set. ## Validation - `Functions.Prompty.UnitTests`: **22/22 pass** (Release, `--warnaserror`). - `Functions.Prompty` and `Concepts` build clean, **no NU1903**. - `dotnet format --verify-no-changes` clean on changed projects. - Behavior coherence: rendered prompt output for the `Concepts` samples is **byte-for-byte identical** to the previously published package, and the samples were run end-to-end against a live model with the expected results. ## Contribution Checklist - [x] The code builds clean without errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) - [x] All unit tests pass, and I have added/updated tests where possible - [x] I didn't break anyone 😄 |
||
|
|
c781da134e |
.Net: fix: address three static analysis issues (audio format, text search, KernelProcess) (#13925)
Fixes #13922 ## Problem Three static analysis issues identified by PVS-Studio in the .NET codebase: 1. **`ClientCore.ChatCompletion.cs`** — `GetAudioOutputMimeType` contained a duplicate `ChatOutputAudioFormat.Wav` check (lines 985 and 1000) making the second branch unreachable. The `Aac` audio format supported by the OpenAI SDK was silently unhandled, causing a `NotSupportedException` at runtime. 2. **`TextSearchStore.cs`** — `GetTextSearchResultsAsync` assigned a LINQ expression to a `results` variable (deferred execution) that was never iterated. The return statement duplicated the projection. The unused variable was dead code. 3. **`KernelProcess.cs`** — The constructor accepted a `threads` parameter but never assigned it to the `Threads` property, silently discarding all threads passed by callers. ## Solution 1. Replace the second `Wav` branch with an `Aac` branch and update the error message to list `'aac'` as a supported format. 2. Reuse the `results` variable in the `return` statement instead of duplicating the `Select` projection. 3. Assign the `threads` parameter to `this.Threads` when it is not null. ## Testing - Changes are logic-only with no new external dependencies. - Existing unit tests for `OpenAIChatCompletionService` and `TextSearchStore` continue to apply. - No new runtime behaviour is introduced for the `Wav` fix (it was already handled earlier in the method); `Aac` now maps to `"audio/aac"` as expected. --------- Co-authored-by: octo-patch <[email protected]> Co-authored-by: Roger Barreto <[email protected]> |
||
|
Eduard van ValkenburgandCopilot
|
dd026f3413 |
Encode OpenAPI server variable values (#14146)
## Summary - validate enum-constrained OpenAPI server variables before substitution - percent-encode substituted server variable values, including defaults - add regression tests for invalid enum values and reserved-character encoding ## Testing - uv run pytest tests/unit/connectors/openapi_plugin/test_sk_openapi.py -q --------- Co-authored-by: Copilot <[email protected]> |
||
|
AZJandRoger Barreto
|
008d40acb4 |
.Net: feat(ollama): add Think property to OllamaPromptExecutionSettings (#14122)
## Summary - Adds `Think` (`bool?`) property to `OllamaPromptExecutionSettings` to control thinking for Ollama reasoning models (deepseek-r1, qwen3, phi4-reasoning) - Maps `Think` to `GenerateRequest.Think` in `OllamaTextGenerationService.CreateRequest()` - Bumps OllamaSharp from 5.4.12 to 5.4.25 which introduces `GenerateRequest.Think` ## Motivation Fixes #14078. When a reasoning model has thinking enabled by default (e.g. qwen3, phi4-reasoning), the model output lands in a separate thinking stream rather than the standard response field. This causes `GetTextContentsAsync` to return empty content. The only way to get a usable response is to pass `think=false` to suppress thinking, but there was no way to set that from `OllamaPromptExecutionSettings`. ## Changes ### `OllamaPromptExecutionSettings.cs` - New `Think` property with `bool?` type, JSON name `think`, `WhenWritingNull` ignore condition, `ThrowIfFrozen()` guard, and `Clone()` support ### `OllamaTextGenerationService.cs` - `CreateRequest()` maps `settings.Think` to `GenerateRequest.Think` using `OllamaSharp.Models.Chat.ThinkValue` ### `Directory.Packages.props` - OllamaSharp bumped from 5.4.12 to 5.4.25 (adds `GenerateRequest.Think` and `ThinkValue`) ### Tests - `OllamaPromptExecutionSettingsTests`: serialization round-trip, Clone, Freeze guard for `Think` - `OllamaTextGenerationTests`: verifies `Think` is present/absent in the serialized request payload for both `GetTextContentsAsync` and `GetStreamingTextContentsAsync` ## Test plan - [ ] All 115 existing unit tests pass (1 pre-existing skip) - [ ] `ThinkPropertyRoundTripsViaSerialization` - `true`/`false` round-trips via JSON - [ ] `ThinkPropertyIsPreservedByClone` - Clone copies the value - [ ] `ThinkPropertyThrowsWhenFrozen` - setter throws after Freeze - [ ] `GetTextContentsShouldSendThinkSettingAsync` - request payload contains correct `think` field - [ ] `GetTextContentsShouldNotSendThinkWhenNotSetAsync` - request payload omits `think` when null - [ ] `GetStreamingTextContentsShouldSendThinkSettingAsync` - streaming path also sends `think` --------- Co-authored-by: Roger Barreto <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
35ba23e1b3 |
.Net: Update package version to 1.78.0 (#14142)
Bumps the SK package version in preparation for the next release. - VersionPrefix: 1.77.0 -> 1.78.0 - PackageValidationBaselineVersion: 1.76.0 -> 1.77.0 --------- Co-authored-by: Copilot <[email protected]>dotnet-1.78.0 |
||
|
Evan Mattson
|
e4025c3446 |
Python: Bump Python version to 1.44.0 for a release (#14141)
### Motivation and Context
Bumps the Python package version for the next release.
### Description
Updates `semantic_kernel.__version__` from `1.43.1` to `1.44.0`.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines and the
pre-submission formatting script raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I did not break anyone 😄
python-1.44.0
|
||
|
|
3df33f7862 |
Python: [Breaking] Update runtime handling (#14135)
This PR updates Python runtime handling and related tests. --------- Co-authored-by: Copilot <[email protected]> Co-authored-by: Evan Mattson <[email protected]> |
||
|
Roger Barreto
|
f6391ad8b6 |
Python: OpenApi: Harden operation path handling for consistent selection and request targeting (.Net & Python) (#14140)
## Motivation and Context The OpenAPI plugin imports operations from a spec and lets the host restrict which operations are exposed via an `OperationSelectionPredicate` (and via `OperationsToExclude`). Operation selection and request-URL construction should share one canonical interpretation of an operation path. This change closes two consistency gaps where a spec-supplied path could be interpreted differently at selection time than at request time. 1. **Selection vs. request path normalization.** The selection predicate received the raw operation path, while the request URL is built from a canonicalized path. An encoded dot-segment (for example `%2e%2e`) is textually different from the endpoint it canonicalizes to, so it could pass a path-based include/exclude filter yet resolve to a different route. Operations whose path contains an encoded or literal dot-segment are now excluded before the predicate is consulted, symmetric with the existing request-time dot-segment rejection. 2. **Request target reconciliation (defense in depth).** After the request URL is built, verify it did not move off the configured server. An operation path that is an absolute or authority-changing URI (for example `https://another-host/admin`) carries no dot-segment, so it passes path-segment validation, yet `System.Uri` / `urljoin` resolve it to a different scheme, host, or port. Such a request is now rejected before it is sent, so a credential-bearing request cannot be redirected to an unintended target. Both changes are applied symmetrically to the .NET and Python OpenAPI ports. ## Description - **.NET** - `OpenApiDocumentParser` skips operations whose path contains a dot-segment before invoking the selection predicate. - `RestApiOperation` extracts a shared `ContainsDotSegment` helper (reused by the existing `ValidatePathSegments`) and, after building the request URL, reconciles its scheme/host/port and base path against the configured server. - **Python** - `openapi_parser` skips dot-segment operations before the predicate runs. - `rest_api_operation` adds a shared `_contains_dot_segment` helper and a post-construction `_ensure_request_target_matches_server` reconciliation. ## Tests - .NET: added selection-exclusion and request-target reconciliation tests; full `Functions.UnitTests` OpenApi suite green (488). - Python: added parity tests for both behaviors; `tests/unit/connectors/openapi_plugin` green (173), ruff + ruff-format + mypy + pre-commit clean. ## Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the SK Contribution Guidelines - [x] All unit tests pass, and I have added new tests where possible |
||
|
SergeyMenshykhandCopilot
|
e6c9673684 |
.Net: Disable automatic HTTP redirects in HttpPlugin and WebFileDownloadPlugin default clients (#14132)
The default HTTP clients used by `HttpPlugin` and `WebFileDownloadPlugin` now have `AllowAutoRedirect` set to `false`. This ensures the `AllowedDomains` restriction is enforced consistently regardless of server responses. - Added `GetNonRedirectingHttpClient()` to `HttpClientProvider` (all target frameworks) - Updated both plugins to use non-redirecting clients by default - Added unit tests verifying redirect responses are not followed - Updated XML documentation Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
f25753be0a |
Bump Scriban from 7.2.0 to 7.2.5 to fix NU1902 vulnerability (#14133)
Fixes CI failure caused by NU1902 errors due to known moderate severity vulnerabilities in Scriban 7.2.0 (GHSA-6q7j-xr26-3h2c, GHSA-q6rr-fm2g-g5x8). Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
38a5480af0 |
Python: Default MCP SSE server samples to loopback with host validation (#14127)
## Motivation and Context The Python MCP server demos under `python/samples/demos/mcp_server/` can optionally run over the SSE transport (`--transport sse`). This updates that sample wiring to follow the Model Context Protocol guidance for local development servers, so developers who use these demos as a starting point inherit sensible defaults. ## Description - **Loopback by default**: the SSE samples now bind to `127.0.0.1` instead of `0.0.0.0`. A new `--host` argument makes binding to other interfaces an explicit opt-in that logs a warning. - **Host/Origin validation**: added Starlette `TrustedHostMiddleware` plus a small Origin allowlist middleware so the local listener only serves loopback callers (requests without an `Origin` header are still allowed, for non-browser MCP clients). - **Sample hygiene**: switched `Starlette(debug=True)` to `debug=False` so the demos don't ship verbose debug output. - **Docs**: the README now describes the loopback-by-default behavior, the `--host` opt-in, and points to the existing `mcp_with_oauth` sample for authenticated, network-reachable deployments. Applies to `sk_mcp_server.py` and `agent_as_server.py`. The stdio transport (the default) and the other stdio-only samples are unchanged. ## Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] I didn't break anyone 😄 --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
efa3268a09 |
Python: Enforce excluded_functions on MCP tool invocation path (#14124)
### Motivation and Context The MCP server created by `create_mcp_server_from_kernel` (and the `Kernel.as_mcp_server` wrapper) accepts an `excluded_functions` argument to keep selected kernel functions off the server. Previously this list was applied only when building the tool set advertised by the `list_tools` handler; the `call_tool` handler did not consult it and forwarded the client-supplied name straight to the kernel. As a result the set of advertised tools and the set of callable tools could diverge. ### Description - Derive a single `exposed_names` set from `functions_to_expose` and check it in the `call_tool` handler, returning a `METHOD_NOT_FOUND` error for any name that is not exposed. - Remove a leftover `print` debug statement in `_call_kernel_function`. - Add a unit test covering the `call_tool` behavior for a non-exposed function. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the SK Contribution Guidelines - [x] All unit tests pass, and I have added new tests where possible --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
dfc5227227 |
.Net: Update .NET SDK to 10.0.301 (#14119)
Updates the .NET SDK version in `dotnet/global.json` from `10.0.100` to `10.0.301`. Co-authored-by: Copilot <[email protected]> |
||
|
|
cf9af8b966 |
.Net: Bump axios to 1.16.0 and form-data to 4.0.6 in /dotnet/samples/Demos/ProcessFrameworkWithSignalR (#13858)
### Motivation and Context This update is required to resolve the current Dependabot security alerts for the sample npm manifest in `dotnet/samples/Demos/ProcessFrameworkWithSignalR`. ### Description Updates the sample manifest to require `axios` `^1.16.0` and regenerates the lockfile so the resolved dependency set includes: - `axios` `1.16.0` - `form-data` `4.0.6` - compatible transitive updates such as `follow-redirects` `1.16.0` These changes keep the scope limited to the sample's `package.json` and `package-lock.json` while clearing the reported npm audit findings for this manifest. ### Contribution Checklist - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: SergeyMenshykh <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
e99c633fba |
.Net: Harden file path validation in Core, Document, and Web plugins (#14118)
## Motivation and Context This change hardens file system path handling in the file-based plugins. Previously, the path used for allowlist validation could differ from the path ultimately used for file I/O, so the two operations were not guaranteed to refer to the same file system location. ## Description - Adds a shared `PathUtilities.GetSafeFullPath` helper that produces a canonical full path for a given input. - Updates `FileIOPlugin`, `SessionsPythonPlugin`, `DocumentPlugin` and `WebFileDownloadPlugin` to validate and perform I/O against the same canonical path, and to compare paths using OS-appropriate string comparison. - Adds regression tests covering the new behavior. ## Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the SK Contribution Guidelines - [x] All unit tests pass, and I have added new tests where possible --------- Co-authored-by: Copilot <[email protected]> |
||
|
dependabot[bot]andSergeyMenshykh
|
99d1953e93 |
Bump axios from 1.13.2 to 1.16.0 in /dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend (#14044)
Bumps [axios](https://github.com/axios/axios) from 1.13.2 to 1.16.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v1.16.0 — May 2, 2026</h2> <p>This release adds support for the QUERY HTTP method and a new <code>ECONNREFUSED</code> error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.</p> <h2>⚠️ Notable Changes</h2> <p>A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:</p> <ul> <li><strong>Fetch adapter now enforces <code>maxBodyLength</code> and <code>maxContentLength</code>.</strong> These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (<strong><a href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>)</li> <li><strong>Proxy requests now preserve user-supplied <code>Host</code> headers.</strong> Previously, the proxy path could overwrite a custom <code>Host</code>. Virtual-host-style routing through a proxy will now behave correctly. (<strong><a href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>)</li> <li><strong>Basic auth credentials embedded in URLs are now URL-decoded.</strong> If you have percent-encoded credentials in a URL (e.g. <code>https://user:p%40ss@host</code>), the decoded value is what now goes on the wire. (<strong><a href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li> <li><strong><code>parseProtocol</code> now strictly requires a colon in the protocol separator.</strong> Strings that loosely parsed as protocols before may no longer match. (<strong><a href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li> <li><strong>Deprecated <code>unescape()</code> replaced with modern UTF-8 encoding.</strong> Non-ASCII URL handling is now spec-correct; consumers depending on legacy <code>unescape()</code> quirks may see different output bytes. (<strong><a href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li> <li><strong><code>transformRequest</code> input typing change was reverted.</strong> The typing change introduced in <a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a> was reverted in <a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a> after follow-up review — net behavior is unchanged from 1.15.2. (<strong><a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>QUERY HTTP Method:</strong> Added support for the QUERY HTTP method across adapters and type definitions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10802">#10802</a></strong>)</li> <li><strong>ECONNREFUSED Error Constant:</strong> Exposed <code>ECONNREFUSED</code> as a constant on <code>AxiosError</code> so callers can match connection-refused failures without comparing string literals (closes <a href="https://redirect.github.com/axios/axios/issues/6485">#6485</a>). (<strong><a href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li> <li><strong>Encode Helper Export:</strong> Exported the internal <code>encode</code> helper from <code>buildURL</code> so userland param serializers can reuse the same encoding logic that axios uses internally. (<strong><a href="https://redirect.github.com/axios/axios/issues/6897">#6897</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>HTTP Adapter — Redirects & Headers:</strong> Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing <code>requestDetails</code> argument on <code>beforeRedirect</code>, preserved user-supplied <code>Host</code> headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (<strong><a href="https://redirect.github.com/axios/axios/issues/10794">#10794</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10800">#10800</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6241">#6241</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li> <li><strong>HTTP Adapter — Streams & Timeouts:</strong> Preserved the partial response object on <code>AxiosError</code> when a stream is aborted after headers arrive, honoured the <code>timeout</code> option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and <code>maxRedirects: 0</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10708">#10708</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10819">#10819</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7149">#7149</a></strong>)</li> <li><strong>Fetch Adapter:</strong> Enforced <code>maxBodyLength</code> / <code>maxContentLength</code> in the fetch adapter, set the <code>User-Agent</code> header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a <code>TypeError</code> in restricted environments. (<strong><a href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10772">#10772</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10806">#10806</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7260">#7260</a></strong>)</li> <li><strong>XHR Adapter:</strong> Unsubscribed the <code>cancelToken</code> and <code>AbortSignal</code> listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li> <li><strong>Error Handling:</strong> Attached the parsed response to <code>AxiosError</code> when <code>JSON.parse</code> fails inside <code>dispatchRequest</code>, prevented <code>settle</code> from emitting <code>undefined</code> error codes, and tightened the <code>parseProtocol</code> regex to require a colon in the protocol separator. (<strong><a href="https://redirect.github.com/axios/axios/issues/10724">#10724</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7276">#7276</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li> <li><strong>Types & Exports:</strong> Aligned the CommonJS <code>CancelToken</code> typings with the ESM build, fixed a compiler error caused by <code>RawAxiosHeaders</code>, and re-exported <code>create</code> from the package index. (<strong><a href="https://redirect.github.com/axios/axios/issues/7414">#7414</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6389">#6389</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6460">#6460</a></strong>)</li> <li><strong>UTF-8 Encoding:</strong> Replaced the deprecated <code>unescape()</code> call with a modern UTF-8 encoding implementation. (<strong><a href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li> <li><strong>Misc Cleanup:</strong> Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (<strong><a href="https://redirect.github.com/axios/axios/issues/10833">#10833</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li><strong>Refactor — ES6 Modernisation:</strong> Modernised the <code>utils</code> module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (<strong><a href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li> <li><strong>Tests:</strong> Hardened the HTTP test server lifecycle to fix flaky <code>FormData</code> EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (<strong><a href="https://redirect.github.com/axios/axios/issues/10820">#10820</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10791">#10791</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10796">#10796</a></strong>)</li> <li><strong>Docs:</strong> Documented <code>paramsSerializer.encode</code> for strict RFC 3986 query encoding, updated the <code>parseReviver</code> TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (<strong><a href="https://redirect.github.com/axios/axios/issues/10821">#10821</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10782">#10782</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10759">#10759</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10804">#10804</a></strong>)</li> <li><strong>Reverted:</strong> Reverted the <code>transformRequest</code> input typing change from <a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a> after follow-up review. (<strong><a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li> <li><strong>Dependencies:</strong> Bumped <code>actions/setup-node</code>, the <code>github-actions</code> group, and <code>postcss</code> (in <code>/docs</code>) to their latest versions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10785">#10785</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10813">#10813</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10814">#10814</a></strong>)</li> <li><strong>Release:</strong> Updated changelog and packages, and prepared the 1.16.0 release. (<strong><a href="https://redirect.github.com/axios/axios/issues/10790">#10790</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10834">#10834</a></strong>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/singhankit001"><code>@singhankit001</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>)</li> <li><strong><a href="https://github.com/cuiweixie"><code>@cuiweixie</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li> <li><strong><a href="https://github.com/iruizsalinas"><code>@iruizsalinas</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li> <li><strong><a href="https://github.com/MarcosNocetti"><code>@MarcosNocetti</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li> <li><strong><a href="https://github.com/deepview-autofix"><code>@deepview-autofix</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h2>v1.16.0 — May 2, 2026</h2> <p>This release adds support for the QUERY HTTP method and a new <code>ECONNREFUSED</code> error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.</p> <h2>⚠️ Notable Changes</h2> <p>A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:</p> <ul> <li><strong>Fetch adapter now enforces <code>maxBodyLength</code> and <code>maxContentLength</code>.</strong> These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (<strong><a href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>)</li> <li><strong>Proxy requests now preserve user-supplied <code>Host</code> headers.</strong> Previously, the proxy path could overwrite a custom <code>Host</code>. Virtual-host-style routing through a proxy will now behave correctly. (<strong><a href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>)</li> <li><strong>Basic auth credentials embedded in URLs are now URL-decoded.</strong> If you have percent-encoded credentials in a URL (e.g. <code>https://user:p%40ss@host</code>), the decoded value is what now goes on the wire. (<strong><a href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li> <li><strong><code>parseProtocol</code> now strictly requires a colon in the protocol separator.</strong> Strings that loosely parsed as protocols before may no longer match. (<strong><a href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li> <li><strong>Deprecated <code>unescape()</code> replaced with modern UTF-8 encoding.</strong> Non-ASCII URL handling is now spec-correct; consumers depending on legacy <code>unescape()</code> quirks may see different output bytes. (<strong><a href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li> <li><strong><code>transformRequest</code> input typing change was reverted.</strong> The typing change introduced in <a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a> was reverted in <a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a> after follow-up review — net behavior is unchanged from 1.15.2. (<strong><a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>QUERY HTTP Method:</strong> Added support for the QUERY HTTP method across adapters and type definitions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10802">#10802</a></strong>)</li> <li><strong>ECONNREFUSED Error Constant:</strong> Exposed <code>ECONNREFUSED</code> as a constant on <code>AxiosError</code> so callers can match connection-refused failures without comparing string literals (closes <a href="https://redirect.github.com/axios/axios/issues/6485">#6485</a>). (<strong><a href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li> <li><strong>Encode Helper Export:</strong> Exported the internal <code>encode</code> helper from <code>buildURL</code> so userland param serializers can reuse the same encoding logic that axios uses internally. (<strong><a href="https://redirect.github.com/axios/axios/issues/6897">#6897</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>HTTP Adapter — Redirects & Headers:</strong> Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing <code>requestDetails</code> argument on <code>beforeRedirect</code>, preserved user-supplied <code>Host</code> headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (<strong><a href="https://redirect.github.com/axios/axios/issues/10794">#10794</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10800">#10800</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6241">#6241</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10822">#10822</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10825">#10825</a></strong>)</li> <li><strong>HTTP Adapter — Streams & Timeouts:</strong> Preserved the partial response object on <code>AxiosError</code> when a stream is aborted after headers arrive, honoured the <code>timeout</code> option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and <code>maxRedirects: 0</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10708">#10708</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10819">#10819</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7149">#7149</a></strong>)</li> <li><strong>Fetch Adapter:</strong> Enforced <code>maxBodyLength</code> / <code>maxContentLength</code> in the fetch adapter, set the <code>User-Agent</code> header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a <code>TypeError</code> in restricted environments. (<strong><a href="https://redirect.github.com/axios/axios/issues/10795">#10795</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10772">#10772</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10806">#10806</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7260">#7260</a></strong>)</li> <li><strong>XHR Adapter:</strong> Unsubscribed the <code>cancelToken</code> and <code>AbortSignal</code> listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li> <li><strong>Error Handling:</strong> Attached the parsed response to <code>AxiosError</code> when <code>JSON.parse</code> fails inside <code>dispatchRequest</code>, prevented <code>settle</code> from emitting <code>undefined</code> error codes, and tightened the <code>parseProtocol</code> regex to require a colon in the protocol separator. (<strong><a href="https://redirect.github.com/axios/axios/issues/10724">#10724</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7276">#7276</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li> <li><strong>Types & Exports:</strong> Aligned the CommonJS <code>CancelToken</code> typings with the ESM build, fixed a compiler error caused by <code>RawAxiosHeaders</code>, and re-exported <code>create</code> from the package index. (<strong><a href="https://redirect.github.com/axios/axios/issues/7414">#7414</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6389">#6389</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/6460">#6460</a></strong>)</li> <li><strong>UTF-8 Encoding:</strong> Replaced the deprecated <code>unescape()</code> call with a modern UTF-8 encoding implementation. (<strong><a href="https://redirect.github.com/axios/axios/issues/7378">#7378</a></strong>)</li> <li><strong>Misc Cleanup:</strong> Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (<strong><a href="https://redirect.github.com/axios/axios/issues/10833">#10833</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li><strong>Refactor — ES6 Modernisation:</strong> Modernised the <code>utils</code> module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (<strong><a href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li> <li><strong>Tests:</strong> Hardened the HTTP test server lifecycle to fix flaky <code>FormData</code> EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (<strong><a href="https://redirect.github.com/axios/axios/issues/10820">#10820</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10791">#10791</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10796">#10796</a></strong>)</li> <li><strong>Docs:</strong> Documented <code>paramsSerializer.encode</code> for strict RFC 3986 query encoding, updated the <code>parseReviver</code> TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (<strong><a href="https://redirect.github.com/axios/axios/issues/10821">#10821</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10782">#10782</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10759">#10759</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10804">#10804</a></strong>)</li> <li><strong>Reverted:</strong> Reverted the <code>transformRequest</code> input typing change from <a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a> after follow-up review. (<strong><a href="https://redirect.github.com/axios/axios/issues/10745">#10745</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10810">#10810</a></strong>)</li> <li><strong>Dependencies:</strong> Bumped <code>actions/setup-node</code>, the <code>github-actions</code> group, and <code>postcss</code> (in <code>/docs</code>) to their latest versions. (<strong><a href="https://redirect.github.com/axios/axios/issues/10785">#10785</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10813">#10813</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10814">#10814</a></strong>)</li> <li><strong>Release:</strong> Updated changelog and packages, and prepared the 1.16.0 release. (<strong><a href="https://redirect.github.com/axios/axios/issues/10790">#10790</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10834">#10834</a></strong>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/singhankit001"><code>@singhankit001</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10588">#10588</a></strong>)</li> <li><strong><a href="https://github.com/cuiweixie"><code>@cuiweixie</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/7419">#7419</a></strong>)</li> <li><strong><a href="https://github.com/iruizsalinas"><code>@iruizsalinas</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10787">#10787</a></strong>)</li> <li><strong><a href="https://github.com/MarcosNocetti"><code>@MarcosNocetti</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10680">#10680</a></strong>)</li> <li><strong><a href="https://github.com/deepview-autofix"><code>@deepview-autofix</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10729">#10729</a></strong>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc"><code>df53d7d</code></a> chore(release): prepare release 1.16.0 (<a href="https://redirect.github.com/axios/axios/issues/10834">#10834</a>)</li> <li><a href="https://github.com/axios/axios/commit/9d92bcd32639d1eea5b89f03ae45f248d3bb058e"><code>9d92bcd</code></a> fix: gadgets and smaller issues (<a href="https://redirect.github.com/axios/axios/issues/10833">#10833</a>)</li> <li><a href="https://github.com/axios/axios/commit/5107ee69aee527b19eabaf80000ca65752135435"><code>5107ee6</code></a> fix: prevent undefined error codes in settle (<a href="https://redirect.github.com/axios/axios/issues/7276">#7276</a>)</li> <li><a href="https://github.com/axios/axios/commit/e57349992f230b6b13e80613eb84302560aa5ba8"><code>e573499</code></a> fix(fetch): defer global access in fetch adapter (<a href="https://redirect.github.com/axios/axios/issues/7260">#7260</a>)</li> <li><a href="https://github.com/axios/axios/commit/ad68e1a484b50086af427f767bbd7d6e3aab7ac3"><code>ad68e1a</code></a> fix(http): honor timeout during connect without redirects (<a href="https://redirect.github.com/axios/axios/issues/10819">#10819</a>)</li> <li><a href="https://github.com/axios/axios/commit/2a51828213128691d2e37502b5eb2cf4965a737d"><code>2a51828</code></a> fix(http): decode URL basic auth credentials (<a href="https://redirect.github.com/axios/axios/issues/10825">#10825</a>)</li> <li><a href="https://github.com/axios/axios/commit/0e8b6bbb542131bae9940618d84d5286255d4db1"><code>0e8b6bb</code></a> fix(http): preserve user-supplied Host header when forwarding through a proxy...</li> <li><a href="https://github.com/axios/axios/commit/79f39e1d041dca87173226d0255f90eaf252564b"><code>79f39e1</code></a> docs: document paramsSerializer.encode for strict RFC 3986 query encoding (<a href="https://redirect.github.com/axios/axios/issues/1">#1</a>...</li> <li><a href="https://github.com/axios/axios/commit/0fe3a5fc14829535e1d517c662d448e86c33438e"><code>0fe3a5f</code></a> [Docs/Types] Update <code>parseReviver</code> TypeScript definitions for ES2023 and add ...</li> <li><a href="https://github.com/axios/axios/commit/cd6737fd84bdb7caf2a319d3579573a49f9d238d"><code>cd6737f</code></a> chore: matches the sibling responseStream.on(aborted) handler and added tests...</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v1.13.2...v1.16.0">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for axios since your current version.</p> </details> <details> <summary>Install script changes</summary> <p>This version modifies <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: SergeyMenshykh <[email protected]> |
||
|
westey
|
82f244233b |
.Net: Update SK to use MEVD packages and move MEVD projects out of main solution (#14117)
### Motivation and Context - The MEVD packages are not shipped from this repo anymore. ### Description - Moving the packages out of the main SK solution - Update all projects to use MEVD.Abstractions package directly - Revert some previous code changes to make the MEVD implementations compatible with the last MEVD.Abstractions package released from this repo. ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
SergeyMenshykhandCopilot
|
88e1060b99 |
Python: Adjust request validation (#14114)
Updates request validation behavior and related tests. --------- Co-authored-by: Copilot <[email protected]> |
||
|
Eduard van ValkenburgandCopilot
|
83bffe197b |
Python: Add OpenAPI server URL validation (#14097)
## Summary - Add server URL validation for Python OpenAPI operation execution before outbound requests are made - Add execution settings for trusted allowed base URLs and private-network access - Pass operation arguments into server variable resolution and add regression coverage for substituted server hosts ## Testing - `uv run pytest tests/unit/connectors/openapi_plugin/test_server_url_validator.py tests/unit/connectors/openapi_plugin/test_openapi_runner.py tests/unit/connectors/openapi_plugin/test_openapi_manager.py tests/unit/connectors/openapi_plugin/test_sk_openapi.py` - `uv run pytest tests/integration/cross_language/test_cross_language.py -k openapi` - `uv run ruff check ...` - `uv run ruff format --check ...` --------- Co-authored-by: Copilot <[email protected]> |
||
|
dependabot[bot]
|
00bad6fed1 |
Bump mistune from 3.2.0 to 3.2.1 in /python (#13965)
Bumps [mistune](https://github.com/lepture/mistune) from 3.2.0 to 3.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lepture/mistune/releases">mistune's releases</a>.</em></p> <blockquote> <h2>v3.2.1</h2> <h3> 🐞 Bug Fixes</h3> <ul> <li>Resolve Windows compatibility issues in file inclusion and tests - by <a href="https://github.com/Yuki9814"><code>@Yuki9814</code></a> <a href="https://github.com/lepture/mistune/commit/2547102"><!-- raw HTML omitted -->(25471)<!-- raw HTML omitted --></a></li> <li>Escape html text - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/a3cb6e5"><!-- raw HTML omitted -->(a3cb6)<!-- raw HTML omitted --></a></li> <li>Update link reference - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/85eb54f"><!-- raw HTML omitted -->(85eb5)<!-- raw HTML omitted --></a></li> <li>Handle escaped dollar signs in inline math - by <a href="https://github.com/saschabuehrle"><code>@saschabuehrle</code></a> in <a href="https://redirect.github.com/lepture/mistune/issues/370">lepture/mistune#370</a> <a href="https://github.com/lepture/mistune/commit/7bd5709"><!-- raw HTML omitted -->(7bd57)<!-- raw HTML omitted --></a></li> <li>Escape id of toc - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/04880a0"><!-- raw HTML omitted -->(04880)<!-- raw HTML omitted --></a></li> <li>Escape id of headings - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/2855622"><!-- raw HTML omitted -->(28556)<!-- raw HTML omitted --></a></li> <li>Remove double-encoding of image alt text - by <a href="https://github.com/lawrence3699"><code>@lawrence3699</code></a> <a href="https://github.com/lepture/mistune/commit/0d6f3d8"><!-- raw HTML omitted -->(0d6f3)<!-- raw HTML omitted --></a></li> <li>Escape xml for math plugin - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/5fa092e"><!-- raw HTML omitted -->(5fa09)<!-- raw HTML omitted --></a></li> <li>Use strict regex for image's height and width - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/8d0cb75"><!-- raw HTML omitted -->(8d0cb)<!-- raw HTML omitted --></a></li> </ul> <h5> <a href="https://github.com/lepture/mistune/compare/v3.2.0...v3.2.1">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/lepture/mistune/blob/main/docs/changes.rst">mistune's changelog</a>.</em></p> <blockquote> <h2>Version 3.2.1</h2> <p><strong>Released on May 3, 2026</strong></p> <ul> <li>Escape link in <code>render_toc_ul</code>.</li> <li>Escape text in math plugin.</li> <li>Fix regex for math plugin.</li> <li>Escape heading's ID attribute.</li> <li>Fix <code>LINK_TITLE_RE</code> to prevent DoS.</li> <li>Escape class attribute for admonition directive.</li> <li>Remove double-encoding of image alt text.</li> <li>Escape class attribute for image directive.</li> <li>Fix width/height attribute for image directive.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lepture/mistune/commit/067f90861088a496942f5eb43236135352b85d39"><code>067f908</code></a> chore: release 3.2.1</li> <li><a href="https://github.com/lepture/mistune/commit/bf5503067a7d8c3b065fb143f67a3a08eca77bb6"><code>bf55030</code></a> Merge pull request <a href="https://redirect.github.com/lepture/mistune/issues/438">#438</a> from saschabuehrle/fix/issue-370</li> <li><a href="https://github.com/lepture/mistune/commit/8d0cb7539a9ac82e633b98476b9922632eb8b948"><code>8d0cb75</code></a> fix: use strict regex for image's height and width</li> <li><a href="https://github.com/lepture/mistune/commit/5fa092e3053b86f16e4c49b9d3ba0b7ab63f09ab"><code>5fa092e</code></a> fix: escape xml for math plugin</li> <li><a href="https://github.com/lepture/mistune/commit/71ec9477ebfcf8dab0068804baf2c77461d77fbb"><code>71ec947</code></a> Merge pull request <a href="https://redirect.github.com/lepture/mistune/issues/440">#440</a> from lawrence3699/fix/image-alt-double-encoding</li> <li><a href="https://github.com/lepture/mistune/commit/0d6f3d850283d51e9c60e5a1b3c9343a18df3722"><code>0d6f3d8</code></a> fix: remove double-encoding of image alt text</li> <li><a href="https://github.com/lepture/mistune/commit/2855622d7fe235c6c805716edff943b5945d1eea"><code>2855622</code></a> fix: escape id of headings</li> <li><a href="https://github.com/lepture/mistune/commit/04880a004cb28318e5ebd7ee9e63c79fc9f9ed04"><code>04880a0</code></a> fix: escape id of toc</li> <li><a href="https://github.com/lepture/mistune/commit/7bd57096715385062505b3f78972be9fa823d6d4"><code>7bd5709</code></a> fix: handle escaped dollar signs in inline math (fixes <a href="https://redirect.github.com/lepture/mistune/issues/370">#370</a>)</li> <li><a href="https://github.com/lepture/mistune/commit/85eb54ff17da26327399bf188f9ff9b8fd515278"><code>85eb54f</code></a> fix: update link reference</li> <li>Additional commits viewable in <a href="https://github.com/lepture/mistune/compare/v3.2.0...v3.2.1">compare view</a></li> </ul> </details> <br /> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
16085866f8 |
Bump urllib3 from 2.6.3 to 2.7.0 in /python (#13978)
### Motivation and Context Bumps <a href="https://github.com/urllib3/urllib3">urllib3</a> from 2.6.3 to 2.7.0 across the Python project, including the `mcp_with_oauth` demo, to pick up the latest security and bug fixes. ### Description - Bumps `urllib3` from 2.6.3 to 2.7.0 in `python/uv.lock` - Bumps `urllib3` from 2.5.0 to 2.7.0 in `python/samples/demos/mcp_with_oauth/uv.lock` so the demo no longer resolves an older urllib3 version ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: Evan Mattson <[email protected]> |
||
|
dependabot[bot]
|
22ee3e0032 |
Python: Bump authlib from 1.6.11 to 1.6.12 in /python (#14004)
Bumps [authlib](https://github.com/authlib/authlib) from 1.6.11 to 1.6.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/authlib/authlib/releases">authlib's releases</a>.</em></p> <blockquote> <h2>v1.6.12</h2> <ul> <li> <ul> <li>Fix redirecting to unvalidated <code>redirect_uri</code> on <code>InvalidScopeError</code> in <code>OpenIDImplicitGrant</code> and <code>OpenIDHybridGrant</code>. <strong>Full Changelog</strong>: <a href="https://github.com/authlib/authlib/compare/v1.6.11...v1.6.12">https://github.com/authlib/authlib/compare/v1.6.11...v1.6.12</a></li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/authlib/authlib/blob/1.6.12/docs/changelog.rst">authlib's changelog</a>.</em></p> <blockquote> <h2>Version 1.6.12</h2> <p><strong>Released on may 4, 2026</strong></p> <ul> <li>Fix redirecting to unvalidated <code>redirect_uri</code> on <code>InvalidScopeError</code> in <code>OpenIDImplicitGrant</code> and <code>OpenIDHybridGrant</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/authlib/authlib/commit/e46e515b3a87ea63ab0606b248d75f69d83a2391"><code>e46e515</code></a> chore: bump to 1.6.12</li> <li><a href="https://github.com/authlib/authlib/commit/9babc131e13b018a267ae78747cba7caa6dfb7d5"><code>9babc13</code></a> fix: redirecting to unvalidated redirect_uri on InvalidScopeError in OIDC grants</li> <li>See full diff in <a href="https://github.com/authlib/authlib/compare/v1.6.11...1.6.12">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
326ecbecd9 |
Python: Bump idna from 3.11 to 3.15 in /python (#14024)
Bumps [idna](https://github.com/kjd/idna) from 3.11 to 3.15. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/kjd/idna/blob/master/HISTORY.md">idna's changelog</a>.</em></p> <blockquote> <h2>3.15 (2026-05-12)</h2> <ul> <li>Enforce DNS-length cap on individual labels early in <code>check_label</code>, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.</li> <li>Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared <code>_unicode_dots_re</code> from <code>idna.core</code> in the codec module.</li> <li>Use <code>raise ... from err</code> for proper exception chaining and switch internal string formatting to f-strings.</li> <li>Allow <code>flit_core</code> 4.x in the build backend.</li> <li>Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.</li> <li>Add Dependabot configuration for GitHub Actions.</li> <li>Convert README and HISTORY from reStructuredText to Markdown.</li> <li>Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.</li> </ul> <p>Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.</p> <h2>3.14 (2026-05-10)</h2> <ul> <li>Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]</li> </ul> <p>Thanks to Stan Ulbrych for reporting the issue.</p> <h2>3.13 (2026-04-22)</h2> <ul> <li>Correct classification error for codepoint U+A7F1</li> </ul> <h2>3.12 (2026-04-21)</h2> <ul> <li>Update to Unicode 17.0.0.</li> <li>Issue a deprecation warning for the transitional argument.</li> <li>Added lazy-loading to provide some performance improvements.</li> <li>Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.</li> </ul> <p>Thanks to Rodrigo Nogueira for contributions to this release.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8"><code>af30a09</code></a> Release 3.15</li> <li><a href="https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2"><code>30314d4</code></a> Pre-release 3.15rc0</li> <li><a href="https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9"><code>05d4b21</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/237">#237</a> from kjd/convert-docs-to-markdown</li> <li><a href="https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee"><code>2987fdb</code></a> Convert README and HISTORY from reStructuredText to Markdown</li> <li><a href="https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c"><code>59fa800</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/236">#236</a> from kjd/dependabot/github_actions/actions-f3e34333ea</li> <li><a href="https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2"><code>def6983</code></a> Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea</li> <li><a href="https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631"><code>bbd8004</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/234">#234</a> from StanFromIreland/patch-1</li> <li><a href="https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc"><code>edd07c0</code></a> Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group</li> <li><a href="https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123"><code>5557db0</code></a> Merge branch 'master' into patch-1</li> <li><a href="https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d"><code>f11746c</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/235">#235</a> from StanFromIreland/patch-2</li> <li>Additional commits viewable in <a href="https://github.com/kjd/idna/compare/v3.11...v3.15">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
f6f47a298c |
Bump pyarrow from 21.0.0 to 23.0.1 in /python (#14058)
Bumps [pyarrow](https://github.com/apache/arrow) from 21.0.0 to 23.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/arrow/releases">pyarrow's releases</a>.</em></p> <blockquote> <h2>Apache Arrow 23.0.1</h2> <p>Release Notes URL: <a href="https://arrow.apache.org/release/23.0.1.html">https://arrow.apache.org/release/23.0.1.html</a></p> <h2>Apache Arrow 23.0.1 RC0</h2> <p>Release Notes: Release Candidate: 23.0.1 RC0</p> <h2>Apache Arrow 23.0.0</h2> <p>Release Notes URL: <a href="https://arrow.apache.org/release/23.0.0.html">https://arrow.apache.org/release/23.0.0.html</a></p> <h2>Apache Arrow 23.0.0 RC2</h2> <p>Release Notes: Release Candidate: 23.0.0 RC2</p> <h2>Apache Arrow 22.0.0</h2> <p>Release Notes URL: <a href="https://arrow.apache.org/release/22.0.0.html">https://arrow.apache.org/release/22.0.0.html</a></p> <h2>Apache Arrow 22.0.0 RC1</h2> <p>Release Notes: Release Candidate: 22.0.0 RC1</p> <h2>Apache Arrow 22.0.0 RC0</h2> <p>Release Notes: Release Candidate: 22.0.0 RC0</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/arrow/commit/82a374e5f3de5b744f26591e6cd96de6349c76d9"><code>82a374e</code></a> MINOR: [Release] Update versions for 23.0.1</li> <li><a href="https://github.com/apache/arrow/commit/c1ae37c4a597f466b1806e65a9e011be1060dfc5"><code>c1ae37c</code></a> MINOR: [Release] Update .deb/.rpm changelogs for 23.0.1</li> <li><a href="https://github.com/apache/arrow/commit/8f6e55736f60f1f95aee1e8765c6b75ad9589111"><code>8f6e557</code></a> MINOR: [Release] Update CHANGELOG.md for 23.0.1</li> <li><a href="https://github.com/apache/arrow/commit/4e16a1aeed83a65e6b49556c2fed8e9061cdf980"><code>4e16a1a</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49159">GH-49159</a>: [C++][Gandiva] Detect overflow in repeat() (<a href="https://redirect.github.com/apache/arrow/issues/49160">#49160</a>)</li> <li><a href="https://github.com/apache/arrow/commit/985621dbfcf3fd2061889e43c50b59825df84f3f"><code>985621d</code></a> <a href="https://redirect.github.com/apache/arrow/issues/48817">GH-48817</a> [R][C++] Bump C++20 in R build infrastructure (<a href="https://redirect.github.com/apache/arrow/issues/48819">#48819</a>)</li> <li><a href="https://github.com/apache/arrow/commit/1bea06ad4e14d75dd97a78a0148cd9cf6f4df0bc"><code>1bea06a</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49024">GH-49024</a>: [CI] Update Debian version in <code>.env</code> (<a href="https://redirect.github.com/apache/arrow/issues/49032">#49032</a>)</li> <li><a href="https://github.com/apache/arrow/commit/147bcd6d8f3fef05dd06968d3b60c17721c60334"><code>147bcd6</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49156">GH-49156</a>: [Python] Require GIL for string comparison (<a href="https://redirect.github.com/apache/arrow/issues/49161">#49161</a>)</li> <li><a href="https://github.com/apache/arrow/commit/e4f922b1621b6c833f583cf26500f115ab5bc483"><code>e4f922b</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49138">GH-49138</a>: [Packaging][Python] Remove nightly cython install from manylinux wh...</li> <li><a href="https://github.com/apache/arrow/commit/f9376e4721b81bad9fe3fe840926a3283f95ee30"><code>f9376e4</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49003">GH-49003</a>: [C++] Don't consider <code>out_of_range</code> an error in float parsing (<a href="https://redirect.github.com/apache/arrow/issues/49095">#49095</a>)</li> <li><a href="https://github.com/apache/arrow/commit/ab2c0ad6b23d05d5f77fc8a34d5a1c4baaacb0a4"><code>ab2c0ad</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49044">GH-49044</a>: [CI][Python] Fix test_download_tzdata_on_windows by adding required...</li> <li>Additional commits viewable in <a href="https://github.com/apache/arrow/compare/apache-arrow-21.0.0...apache-arrow-23.0.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]andGitHub Copilot
|
03f73aee5e |
Python: Bump torch from 2.8.0 to 2.12.0 in /python (#14065)
Bumps [torch](https://github.com/pytorch/pytorch) from 2.8.0 to 2.12.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pytorch/pytorch/releases">torch's releases</a>.</em></p> <blockquote> <h1>PyTorch 2.12.0 Release Notes</h1> <ul> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#highlights">Highlights</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes">Backwards Incompatible Changes</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#deprecations">Deprecations</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#new-features">New Features</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#improvements">Improvements</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes">Bug fixes</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#performance">Performance</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#documentation">Documentation</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#developers">Developers</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#security">Security</a></li> </ul> <h1>Highlights</h1> <!-- raw HTML omitted --> <p>For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.</p> <h1>Backwards Incompatible Changes</h1> <h2>Build Frontend</h2> <ul> <li> <p>Strengthened SVE compile checks in <code>FindARM.cmake</code>, which may reject previously accepted but incorrect SVE configurations (<a href="https://redirect.github.com/pytorch/pytorch/pull/176646">#176646</a>)</p> <p>Source builds that enable SVE now validate the compiler configuration more strictly. If a build previously passed with an incomplete or mismatched SVE setup, it may now fail during CMake configuration instead of later in compilation. Update the compiler/toolchain flags so they accurately describe the target SVE support, or disable SVE for that build.</p> </li> <li> <p>Updated the minimum CUDA version required to build PyTorch from source to CUDA 12.6 (<a href="https://redirect.github.com/pytorch/pytorch/pull/178925">#178925</a>)</p> <p>Building PyTorch from source with CUDA versions older than 12.6 is no longer supported. Users building custom binaries should install CUDA 12.6 or newer and make sure <code>CUDA_HOME</code> points to that installation.</p> <p>Version 2.11:</p> <pre lang="bash"><code>CUDA_HOME=/usr/local/cuda-12.4 python setup.py develop </code></pre> <p>Version 2.12:</p> <pre lang="bash"><code>CUDA_HOME=/usr/local/cuda-12.6 python setup.py develop </code></pre> </li> <li> <p>Enforced a C++20 minimum in CMake build files (<a href="https://redirect.github.com/pytorch/pytorch/pull/178662">#178662</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pytorch/pytorch/commit/0d62256a2b23365f8e1604297eb23a6545102aa8"><code>0d62256</code></a> [release] Dockerfile: skip torchaudio install when CUDA_PATH=cu132 (<a href="https://redirect.github.com/pytorch/pytorch/issues/183346">#183346</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/7661cd9c6b841b62b7f411aa52ec51f05457263b"><code>7661cd9</code></a> [MPS] Fix SDPA wrong output for permuted q/k/v with B > 1 (<a href="https://redirect.github.com/pytorch/pytorch/issues/181886">#181886</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/9da6087ab64ab6a2118686420ca5353c90dd7e1f"><code>9da6087</code></a> Fix stale PYTORCH_RELEASES_CODE_CC dict (fixes <a href="https://redirect.github.com/pytorch/pytorch/issues/182250">#182250</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182369">#182369</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/e4c37cc011d47246ce8ea4b99c9b28fb7f400224"><code>e4c37cc</code></a> Avoid raw stream name collisions in Inductor (<a href="https://redirect.github.com/pytorch/pytorch/issues/182178">#182178</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/822d047dc8dd8d919f83c3ad5c786e405075d1f0"><code>822d047</code></a> [MPS] Fix bool mask handling in 1-pass SDPA decode kernel (<a href="https://redirect.github.com/pytorch/pytorch/issues/182285">#182285</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182311">#182311</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/5c5e523cd520e6986006e45be243b3ee927ea546"><code>5c5e523</code></a> Add enable_gqa parameter to SDPA MPS meta registration (<a href="https://redirect.github.com/pytorch/pytorch/issues/181550">#181550</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/eece52ead16886e5463c3dcee9b04db783cc68d5"><code>eece52e</code></a> [AOTI] Add BC-safe c_shim v2 for _scaled_dot_product_attention_math_for_mps e...</li> <li><a href="https://github.com/pytorch/pytorch/commit/b39330bbe210b9628207e84d8ba2cabb7975fbac"><code>b39330b</code></a> [Inductor] Call latest c_shim version for versioned fallback ops (<a href="https://redirect.github.com/pytorch/pytorch/issues/181548">#181548</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/06f10d088229a25ac52bd14b6cacc04a4161f6ca"><code>06f10d0</code></a> Revert "[FSDP2] add fqn to communication ops" (<a href="https://redirect.github.com/pytorch/pytorch/issues/182100">#182100</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182157">#182157</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/449e3393139a1aca9afec120c9a63f98f12d55b0"><code>449e339</code></a> Revert "[Inductor] Improve materialization heuristic for a chain of computaio...</li> <li>Additional commits viewable in <a href="https://github.com/pytorch/pytorch/compare/v2.8.0...v2.12.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: GitHub Copilot <[email protected]> |
||
|
dependabot[bot]andcopilot-swe-agent[bot]
|
91efa2120c |
Python: Bump bleach from 6.3.0 to 6.4.0 in /python (#14089)
Bumps [bleach](https://github.com/mozilla/bleach) from 6.3.0 to 6.4.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/mozilla/bleach/blob/main/CHANGES">bleach's changelog</a>.</em></p> <blockquote> <h2>Version 6.4.0 (June 5th, 2026)</h2> <p><strong>NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues.</strong> See issue: <code><https://github.com/mozilla/bleach/issues/698></code>__</p> <p><strong>Backwards incompatible changes</strong></p> <ul> <li>Dropped support for pypy 3.10. (<a href="https://redirect.github.com/mozilla/bleach/issues/764">#764</a>)</li> </ul> <p><strong>Security fixes</strong></p> <ul> <li> <p>Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.</p> <p>Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.</p> <p>For example::</p> <p>import bleach payload1 = '<!-- raw HTML omitted -->Click<!-- raw HTML omitted -->' result1 = bleach.clean(payload1) print(repr(result1))</p> <p>outputs::</p> <p>'<!-- raw HTML omitted -->Click<!-- raw HTML omitted -->'</p> <p>See the advisory for details.</p> </li> <li> <p>Fix GHSA-gj48-438w-jh9v.</p> <p>Fix issue where URI sanitization wasn't happening in formaction attributes.</p> <p>See the advisory for details.</p> </li> </ul> <p><strong>Bug fixes</strong></p> <ul> <li> <p>Add support for pypy 3.11. (<a href="https://redirect.github.com/mozilla/bleach/issues/764">#764</a>)</p> </li> <li> <p>Drop version max in tinycss2 pin. (<a href="https://redirect.github.com/mozilla/bleach/issues/772">#772</a>)</p> <p>This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mozilla/bleach/commit/f0355a7af00500482c5292c6c83290c6a178068d"><code>f0355a7</code></a> fix: fix last release date in CHANGES</li> <li><a href="https://github.com/mozilla/bleach/commit/ae4e8a26706516ad01b92e66321b480208a440da"><code>ae4e8a2</code></a> chore: bleach 6.4.0 and final release</li> <li><a href="https://github.com/mozilla/bleach/commit/970df58e9f0c55cc52244f3f0106e473a40d886d"><code>970df58</code></a> fix: uri-sanitization in formaction attributes</li> <li><a href="https://github.com/mozilla/bleach/commit/7c4867c32344d1c961107fae62240a6f0dc680dc"><code>7c4867c</code></a> fix: xss bypass in allowed protocol test using unicode invisible characters</li> <li><a href="https://github.com/mozilla/bleach/commit/913ab75992b845e2c9c060c41f24d46921db4693"><code>913ab75</code></a> fix: reduce redundancy in workflow jobs</li> <li><a href="https://github.com/mozilla/bleach/commit/218c15af455c8dec14f98fcb2e235f8680e93930"><code>218c15a</code></a> fix: rework pip caching</li> <li><a href="https://github.com/mozilla/bleach/commit/4f0b097bf80548a022050e2f71f024d755a9f154"><code>4f0b097</code></a> fix: fix tox platform restrictions</li> <li><a href="https://github.com/mozilla/bleach/commit/e95a79d07bb5d792425c2bc0ef5dd03f6614f3bb"><code>e95a79d</code></a> chore: update pytest</li> <li><a href="https://github.com/mozilla/bleach/commit/91539d4e80d4685b8f2bedc79076ff0ff6c1b911"><code>91539d4</code></a> Bump actions/cache from 5.0.3 to 5.0.4</li> <li><a href="https://github.com/mozilla/bleach/commit/cd47b4ce495859065da23c2116f651e591e1e90d"><code>cd47b4c</code></a> fix: handle left-angle-bracket that's not a tag (<a href="https://redirect.github.com/mozilla/bleach/issues/733">#733</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mozilla/bleach/compare/v6.3.0...v6.4.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> |
||
|
dependabot[bot]andwestey
|
8ce2bcc07f |
.Net: Bump Aspire.Hosting.Azure.CognitiveServices from 13.0.0 to 13.3.0 (#13996)
Updated [Aspire.Hosting.Azure.CognitiveServices](https://github.com/microsoft/aspire) from 13.0.0 to 13.3.0. <details> <summary>Release notes</summary> _Sourced from [Aspire.Hosting.Azure.CognitiveServices's releases](https://github.com/microsoft/aspire/releases)._ ## 13.3.0 # Aspire 13.3.0 Aspire 13.3 is here! 🚀 This release is packed with new ways to deploy, debug, and build distributed apps — including `aspire destroy`, browser telemetry in the dashboard, Kubernetes deployment, first-class JavaScript publishing, and major TypeScript AppHost parity improvements. ## Highlights - 🧹 **Clean teardown** — New **`aspire destroy`** tears down Azure, Kubernetes, and Docker Compose deployments, and pipeline summaries make deploy/publish/destroy runs easier to follow. - 🔍 **Frontend telemetry** — **Aspire.Hosting.Browsers** captures browser console logs, network requests, and screenshots right in the Aspire dashboard. - ☸️ **Kubernetes deploy preview** — **`aspire deploy`** can now generate Helm-based Kubernetes deployments, with first-class Ingress and Gateway API routing. - 🟨 **JavaScript publishing** — New **`PublishAs*`** methods support static sites, Node servers, npm-script apps, Next.js, Vite, Bun, Yarn, and pnpm. - 🌐 **TypeScript AppHost parity** — Unified `withEnvironment`, Docker Compose hooks, endpoint expressions, Azure Container Apps domains, and more close the gap with C# AppHosts. - 🛠️ **CLI upgrades** — Run the standalone dashboard with **`aspire dashboard run`**, install the CLI as a NativeAOT `dotnet tool`, and search API docs from the terminal. - ☁️ **Azure goodness** — New Azure Front Door, Network Security Perimeter, AKS, private endpoint, and Foundry Prompt Agent support. - 🐳 **Better containers** — The Aspire container tunnel is now enabled by default for consistent host connectivity across Docker Desktop, Docker Engine, and Podman. ## ⚠️ Breaking changes Notable breaking changes include `--log-level` becoming `--pipeline-log-level`, the dashboard MCP server being replaced by `aspire agent init`, `dotnet new aspire-py-starter` moving to `aspire new aspire-py-starter`, and several API shape updates across AKS, Foundry, JavaScript diagnostics, and TypeScript AppHost helpers. See the full list in the [Aspire 13.3 breaking changes](https://aspire.dev/whats-new/aspire-13-3/#%EF%B8%8F-breaking-changes). ## 📖 Learn more For the full details, examples, migration guidance, and everything new in this release, check out [What's new in Aspire 13.3](https://aspire.dev/whats-new/aspire-13-3/). Thank you to all the community contributors who helped make Aspire 13.3 possible! 💜 ## 13.2.4 # Aspire 13.2.4 ## What's New in Aspire 13.2.4 Patch release addressing a security advisory in OpenTelemetry dependencies. ### 🐛 Fixes - 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#16420) ### 🏷️ Housekeeping - 🚀 Bumped branding to 13.2.4 (#16436) ## 13.2.3 # What's New in Aspire 13.2.3 Patch release focused on CLI packaging, signing, and reliability fixes. ## 🐛 Fixes - 🛑 aspire stop now properly cleans up application containers on Windows (#16123) - 🔐 Fixed macOS signing, permissions, and certificate trust with improved CI verification (#16053) - ✍️ Fixed signing for the aspire-managed bundle payload (#16211) - 🎭 Fixed Playwright CLI provenance verification for the new tag format (#16134) - 🧭 Updated service discovery environment variables (#16223) ## 🔧 Improvements - 📊 Removed telemetry API data limits and refactored URL builders (#16023) - ⏱️ Increased native build + sign timeout to 60 minutes for reliability (#16212) ## 🏷️ Housekeeping - 🔖 Bumped branding to 13.2.3 (#16181) - 🧪 Temporarily disabled Verify CLI archive step on Windows while investigating (#16276, #16285) ## 13.2.2 This is a servicing release focused on bug fixes and platform improvements. 🐛 Bug Fixes - Fix SqlClient runtime asset layout on Unix — Resolved an issue where Microsoft.Data.SqlClient failed to load correctly on macOS and Linux due to incorrect NuGet asset layout (#15709) - Fix IDE execution regressions for Azure Functions and class library projects — Backported fixes for 13.2 regressions impacting IDE-based execution (#15714) - Fix NpmRunner multi-version output parsing — npm view returning multiple versions no longer breaks version resolution; also bumps @playwright/cli to >=0.1.3 (#15746) - Skip name validation for internal resources — ProjectRebuilderResource, installer, and venv creator resources no longer fail the 64-char name limit since they're never deployed (#15726, fixes #15693) 🔒 Security & Certificates - Use ASP.NET Core dev cert for DCP — Avoids ephemeral certificate trust issues by using the standard ASP.NET Core developer certificate (#15718) - Cache PFX dev certs on Windows and Linux — Prevents binary-level changes between runs for persistent container scenarios (#15774) 🏗️ Infrastructure & Platform - ARM64 CLI support — Added win-arm64 and linux-arm64 to the native CLI archive build matrix (#15599) - Update DCP to 0.22.11 (#15713) 💻 CLI Improvements - Show anonymous dashboard URLs in aspire ps — The dashboard URL is now displayed even when running without authentication (#15731 ## 13.2.1 🐛 Bug Fixes - 🖥️ CLI bundles for ARM & musl — win-arm64, linux-arm64, and linux-musl-x64 bundles now correctly include DCP instead of silently producing broken installs (#15529) - ⚡ aspire new in VS Code — Fixed a race where the workspace switch severed the CLI terminal before the agent init prompt could complete (#15553) - 🔗 Dashboard resource URLs — The describe command no longer produces broken dashboard links with a stray /login?t=... in the path (#15495) - 🌍 Guest AppHost env vars — Launch profile environment variables are now correctly forwarded to guest AppHosts (#15637) - 📦 Legacy settings migration — .aspire/settings.json → aspire.config.json migration was silently skipped in some scenarios; now works reliably (#15526) - 🔧 TypeScript AppHost restore — Fixed config resolution during TS AppHost restore (#15625) - 🎭 Playwright CLI on Windows — aspire agent init now correctly installs playwright-cli on Windows (#15559) - 📌 Emulator stability — Pinned Kusto emulator image and improved Cosmos DB emulator reliability (#15504) ✨ Improvements - 🏗️ Brownfield TypeScript aspire init — Running aspire init in existing JS/TS projects now smartly merges package.json — scripts, dependencies, and engines — with semver-aware conflict handling (#15123) - 🎯 Endpoint filtering — New ExcludeReferenceEndpoint property lets you filter specific endpoints from WithReference (#15586) - 🌐 More polyglot ATS APIs — Exported additional hosting APIs for TypeScript and Go AppHost authoring (#15557) - 🔍 Short trace ID support — The dashboard now resolves short trace IDs in addition to full-length ones (#15613) - ⚠️ Aspire.Hosting.NodeJs deprecated — Use Aspire.Hosting.JavaScript instead; the old package no longer appears in aspire add (#15686) ## 13.2.0 # Aspire 13.2 Aspire 13.2 brings major CLI enhancements, a new TypeScript AppHost (preview), dashboard data export/import, Microsoft Foundry integration, and multi-language improvements — all focused on making local development more streamlined for developers and AI coding agents alike. ## Highlights - 🛠️ CLI overhaul — New commands including **aspire start/stop/ps** for detached mode, **aspire describe** for resource monitoring, **aspire doctor** for environment diagnostics, **aspire secret** for managing user secrets, **aspire docs** for browsing documentation from the terminal, and **aspire agent** (renamed from **aspire mcp**) for AI agent integration. - 🌐 TypeScript AppHost (preview) — Write your apphost in TypeScript with **createBuilder()**, using the same app model concepts as C#. Full VS Code extension support included. - 🧩 VS Code extension — Dedicated Aspire Activity Bar panel with live resource state, inline CodeLens with health status and actions, gutter decorations, and a new Getting Started walkthrough. - 📊 Dashboard improvements — Bulk telemetry export/import, export environment variables as **.env** files, a new telemetry HTTP API, set parameters directly from the dashboard, and improved resource graph layout. - 🤖 Microsoft Foundry — Replaces Azure AI Foundry integration with broader **Aspire.Hosting.Foundry** support including hosted agents and model deployments. - 🔒 Azure Virtual Network & Private Endpoints — New **Aspire.Hosting.Azure.Network** integration for defining VNets, subnets, NAT gateways, NSGs, and private endpoints directly in your apphost. - 🐳 Docker Compose publishing — Generate docker-compose.yaml from your app model with **AddDockerComposeEnvironment.** - 📦 New integrations — Azure Data Lake Storage, MongoDB EF Core (**Aspire.MongoDB.EntityFrameworkCore**), Bun support for JS resources, and Certbot for automated SSL certificates. - ⚡ App model — **WithMcpServer** for declaring MCP endpoints, **rebuild** command for project resources, contextual endpoint resolution, and improved secret/certificate handling. ## ⚠️ Breaking changes Notable breaking changes include service discovery env vars now using endpoint scheme instead of name, aspire.config.json replacing split config files, AIFoundry → Foundry rename, WithSecretBuildArg → WithBuildSecret, and updated default Azure credential behavior. [See the full list of breaking changes](https://aspire.dev/whats-new/aspire-13-2/#%EF%B8%8F-breaking-changes). ## 📖 Learn more For the full details on everything in this release, check out the [What's new in Aspire 13.2](https://aspire.dev/whats-new/aspire-13-2/) documentation. Thank you to all the community contributors who helped make this release happen! 💜 ## 13.1.3 ## What's Changed * [release/13.1] Add installer publishing updates for 13.1.3 by @radical in https://github.com/dotnet/aspire/pull/15158 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.2...v13.1.3 ## 13.1.2 ## What's Changed * Bump patch version from 13.1.1 to 13.1.2 by @Copilot in https://github.com/dotnet/aspire/pull/14699 * [release/13.1] Fix template version parsing for .NET 10.0 SDK separator change by @JamesNK in https://github.com/dotnet/aspire/pull/14698 * Update pipeline images to non-deprecated pools by @joperezr in https://github.com/dotnet/aspire/pull/14707 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.1...v13.1.2 ## 13.1.1 ## What's Changed * [release/13.1] Ensure WithHostHttpsPort works when chained inline by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13678 * [release/13.1] Escape backslashes in path string to discovered vite config by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13822 * [release/13.1] [Testing] Fixing bugs for sticky slot app settings by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13810 * [release/13.1] Fix AzureBicepResource file-not-found error when using templateFile with AzurePublishingContext by @github-actions[bot] in https://github.com/dotnet/aspire/pull/14018 * [release/13.1] Filter dev certs without X509SubjectKeyIdentifierExtension when any cert has it by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13676 * [release/13.1] Fix Aspire.ProjectTemplates build failure from command line length limits by @github-actions[bot] in https://github.com/dotnet/aspire/pull/14009 * [release/13.1] Update Azure.Identity package version to 1.17.1 by @eerhardt in https://github.com/dotnet/aspire/pull/14251 * Bump patch version from 13.1.0 to 13.1.1 by @Copilot in https://github.com/dotnet/aspire/pull/14329 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.0...v13.1.1 ## 13.1.0 We are excited to share that our 13.1.0 release of Aspire has shipped! All of the packages are available in NuGet.org now. Head over to https://aspire.dev/whats-new/aspire-13-1/ to find what's new in 13.1.0! ## What's Changed * Target net10.0 in client integrations by @eerhardt in https://github.com/dotnet/aspire/pull/12500 * Fix DockerComposeEnvironment duplicating image names in .env file by @Copilot in https://github.com/dotnet/aspire/pull/12310 * Replace apt-get with npm for Azure Functions Core Tools installation by @Copilot in https://github.com/dotnet/aspire/pull/12537 * Improve flaky dashboard integration test by @JamesNK in https://github.com/dotnet/aspire/pull/12534 * Add README.md for the Aspire.Hosting.Azure.AppService package by @ShilpiRach in https://github.com/dotnet/aspire/pull/12528 * Add support to enable automatic scaling for App Service Environment by @ShilpiRach in https://github.com/dotnet/aspire/pull/12305 * Update to FluentUI 4.13.1 by @JamesNK in https://github.com/dotnet/aspire/pull/12532 * Skip playground projects in build-packages workflow by @Copilot in https://github.com/dotnet/aspire/pull/12547 * Allow HostUrl to remap both address and port by @danegsta in https://github.com/dotnet/aspire/pull/12521 * Refactor NodeJs Integration by @eerhardt in https://github.com/dotnet/aspire/pull/12530 * Fix MCP endpoint with redirect HTTPS by @JamesNK in https://github.com/dotnet/aspire/pull/12556 * [main] Update dependencies from microsoft/usvc-apiserver by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12540 * Refactor AddNodeApp by @eerhardt in https://github.com/dotnet/aspire/pull/12538 * Update Aspire branding from 13.0 to 13.1 by @Copilot in https://github.com/dotnet/aspire/pull/12527 * Add annotation to specify custom base images for generated Dockerfiles by @Copilot in https://github.com/dotnet/aspire/pull/12566 * Fix generating random MCP endpoint URL in templates by @JamesNK in https://github.com/dotnet/aspire/pull/12558 * [CI] Add new Agent for disabling or quarantining tests by @radical in https://github.com/dotnet/aspire/pull/12570 * Add `ExcludeFromMcp()` resource extension by @JamesNK in https://github.com/dotnet/aspire/pull/12515 * Localized file check-in by OneLocBuild Task: Build definition ID 1309: Build ID 2828818 by @dotnet-bot in https://github.com/dotnet/aspire/pull/12546 * Register IPipelineOutputService in DI for pipeline output directory management by @Copilot in https://github.com/dotnet/aspire/pull/12563 * Add deploy support for Docker Compose by @captainsafia in https://github.com/dotnet/aspire/pull/12548 * Quarantine flaky test: AzureServiceBusEmulatorResourceGeneratesConfigJsonWithCustomizations by @Copilot in https://github.com/dotnet/aspire/pull/12578 * Update connection properties for non-Azure resources by @sebastienros in https://github.com/dotnet/aspire/pull/12583 * Filter to highest package version per channel in aspire add command by @Copilot in https://github.com/dotnet/aspire/pull/12553 * Log DCP messages at Debug/Trace level in AppHost by @Copilot in https://github.com/dotnet/aspire/pull/12533 * Add CLI self-update prompts to `aspire update` command by @Copilot in https://github.com/dotnet/aspire/pull/12395 * Fix golang and alpine images. by @mitchdenny in https://github.com/dotnet/aspire/pull/12592 * Replace ContainerTargetPlatform.AllLinux with LinuxAmd64 by @Copilot in https://github.com/dotnet/aspire/pull/12596 * [main] Update dependencies from microsoft/usvc-apiserver by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12610 * Make IReportingStep and IReportingTask completion idempotent by @Copilot in https://github.com/dotnet/aspire/pull/12602 * Show --log-level debug hint when pipeline fails by @Copilot in https://github.com/dotnet/aspire/pull/12603 * [main] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12622 * Rename app.py to main.py in template by @eerhardt in https://github.com/dotnet/aspire/pull/12628 * bump extension version by @adamint in https://github.com/dotnet/aspire/pull/12623 * don't build apphost in cli when running in extension by @adamint in https://github.com/dotnet/aspire/pull/12621 * Detect which version of yarn is being used by @eerhardt in https://github.com/dotnet/aspire/pull/12633 * Fix duplicate key exception when using WithExplicitStart() on resources with environment callbacks by @Copilot in https://github.com/dotnet/aspire/pull/12604 * Support AddCSharpApp, fix some rough edges around project resources by @adamint in https://github.com/dotnet/aspire/pull/12568 * Add missing namespace to `CertificateAuthorityCollectionResource` by @danegsta in https://github.com/dotnet/aspire/pull/12639 * Add ModelContextProtocol assemblies to signing list by @joperezr in https://github.com/dotnet/aspire/pull/12637 * Generate fallback Dockerfile for Python apps without UV by @Copilot in https://github.com/dotnet/aspire/pull/12627 * Update/bump container image tags for hosting components by @joperezr in https://github.com/dotnet/aspire/pull/12459 * Mark IDeveloperCertificateService experimental by @danegsta in https://github.com/dotnet/aspire/pull/12648 * Wait with exponential backoff for expected Executables by @karolz-ms in https://github.com/dotnet/aspire/pull/12647 * Make ProcessCertificateTrustConfigAsync internal by @danegsta in https://github.com/dotnet/aspire/pull/12649 * Add test cases and ensure container cert override paths work by @danegsta in https://github.com/dotnet/aspire/pull/12654 * Python hosting: Support .venv lookup by walking up parent directories by @Copilot in https://github.com/dotnet/aspire/pull/12616 ... (truncated) ## 13.0.2 This patch is updating our Project Templates for our Python starter app to ensure we depend on the latest version of React. This is out of an abundance of caution, as we don't depend on any of the react packages that were flagged as vulnerable in https://github.com/advisories/GHSA-fv66-9v8q-g76r. ## What's Changed * Bump patch version from 13.0.1 to 13.0.2 by @Copilot in https://github.com/dotnet/aspire/pull/13324 * Update React and ReactDOM to version 19.2.1 across all projects by @joperezr in https://github.com/dotnet/aspire/pull/13325 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.0.1...v13.0.2 ## 13.0.1 ## What's Changed * Merge internal changes by @joperezr in https://github.com/dotnet/aspire/pull/12896 * [release/13.0] Fix Azure roles resources always redeploying by @github-actions[bot] in https://github.com/dotnet/aspire/pull/12903 * [release/13.0] Remove .py and .js files from being signed (#13005) by @eerhardt in https://github.com/dotnet/aspire/pull/13032 * [release/13.0] Fix subscription ID not being disabled on Azure provisioning dialog by @github-actions[bot] in https://github.com/dotnet/aspire/pull/12913 * [release/13.0] Default OpenAISettings.EnableSensitiveTelemetryData to TelemetryHelpers.EnableSensitiveDataDefault by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13017 * Bump patch version from 13.0.0 to 13.0.1 by @Copilot in https://github.com/dotnet/aspire/pull/13167 * [release/13.0] EndpointReference evaluation should wait on missing AllocatedEndpoint (#13074) by @karolz-ms in https://github.com/dotnet/aspire/pull/13076 * [release/13.0] Update to Npgsql 10 by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13166 * [release/13.0] Update dependencies from microsoft/usvc-apiserver by @danegsta in https://github.com/dotnet/aspire/pull/13187 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.0.0...v13.0.1 Commits viewable in [compare view](https://github.com/microsoft/aspire/compare/v13.0.0...v13.3.0). </details> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: westey <[email protected]> |
||
|
|
20be253d7b |
.Net: Bump esbuild, @vitejs/plugin-react, vite, and transitive lockfile deps in /dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend (#14070)
### Motivation and Context This PR updates the ReactFrontend build toolchain dependencies and also resolves additional Dependabot alerts that target the same frontend lockfile manifests. ### Description - Removes `esbuild` (no longer directly used) - Updates `@vitejs/plugin-react` from `4.3.4` to `6.0.2` - Updates `vite` from `6.4.1` to `8.0.16` - Updates transitive lockfile entries in `package-lock.json` and `yarn.lock` for: - `js-yaml` to `4.2.0` - `ws` to `7.5.11` - `mdast-util-to-hast` to `13.2.1` These dependency updates were kept scoped to `dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend`. ### Contribution Checklist - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: Evan Mattson <[email protected]> |
||
|
|
13f812b825 |
Python: Update pymongo requirement from <4.16,>=4.8.0 to >=4.8.0,<4.17 in /python (#13866)
Updates the requirements on [pymongo](https://github.com/mongodb/mongo-python-driver) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mongodb/mongo-python-driver/releases">pymongo's releases</a>.</em></p> <blockquote> <h2>PyMongo 4.16.0</h2> <p>Community notes: <!-- raw HTML omitted --></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/mongodb/mongo-python-driver/blob/master/doc/changelog.rst">pymongo's changelog</a>.</em></p> <blockquote> <h2>Changes in Version 4.16.0 (2026/01/07)</h2> <p>PyMongo 4.16 brings a number of changes including:</p> <ul> <li>Removed invalid documents from :class:<code>bson.errors.InvalidDocument</code> error messages as doing so may leak sensitive user data. Instead, invalid documents are stored in :attr:<code>bson.errors.InvalidDocument.document</code>.</li> <li>PyMongo now requires <code>dnspython>=2.6.1</code>, since <code>dnspython</code> 1.0 is no longer maintained. The minimum version is <code>2.6.1</code> to account for <code>CVE-2023-29483 <https://www.cve.org/CVERecord?id=CVE-2023-29483></code>_.</li> <li>Removed support for Eventlet. Eventlet is actively being sunset by its maintainers and has compatibility issues with PyMongo's dnspython dependency.</li> <li>Use Zstandard support from the standard library for Python 3.14+, and use <code>backports.zstd</code> for older versions.</li> <li>Fixed return type annotation for <code>find_one_and_*</code> methods on :class:<code>~pymongo.asynchronous.collection.AsyncCollection</code> and :class:<code>~pymongo.synchronous.collection.Collection</code> to include <code>None</code>.</li> <li>Added support for NumPy 1D-arrays in :class:<code>bson.binary.BinaryVector</code>.</li> <li>Prevented :class:<code>~pymongo.encryption.ClientEncryption</code> from loading the crypt shared library to fix "MongoCryptError: An existing crypt_shared library is loaded by the application" unless the linked library search path is set.</li> </ul> <h2>Changes in Version 4.15.5 (2025/12/02)</h2> <p>Version 4.15.5 is a bug fix release.</p> <ul> <li>Fixed a bug that could cause <code>AutoReconnect("connection pool paused")</code> errors when cursors fetched more documents from the database after SDAM heartbeat failures.</li> </ul> <h2>Changes in Version 4.15.4 (2025/10/21)</h2> <p>Version 4.15.4 is a bug fix release.</p> <ul> <li>Relaxed the callback type of :meth:<code>~pymongo.asynchronous.client_session.AsyncClientSession.with_transaction</code> to allow the broader Awaitable type rather than only Coroutine objects.</li> <li>Added the missing Python 3.14 trove classifier to the package metadata.</li> </ul> <p>Issues Resolved ...............</p> <p>See the <code>PyMongo 4.15.4 release notes in JIRA</code>_ for the list of resolved issues in this release.</p> <p>.. _PyMongo 4.15.4 release notes in JIRA: <a href="https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=47237">https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=47237</a></p> <h2>Changes in Version 4.15.3 (2025/10/07)</h2> <p>Version 4.15.3 is a bug fix release.</p> <ul> <li>Fixed a memory leak when raising :class:<code>bson.errors.InvalidDocument</code> with C extensions.</li> <li>Fixed the return type of the :meth:<code>~pymongo.asynchronous.collection.AsyncCollection.distinct</code>,</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/32901018ca14d9acb05004a88d65b6ab0b29c877"><code>3290101</code></a> Prepare 4.16.0 release (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2672">#2672</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/1be94d262dd0281b032b6f9e56d381cac3a7a6d9"><code>1be94d2</code></a> PYTHON-5685 Fix unified spec sync metadata for csot and sessions tests (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2669">#2669</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/6585d9cb51d5c9b2d85eec4f49b8196612d9e8ee"><code>6585d9c</code></a> PYTHON-2442: Refactor: use _asdict() in _options_dict() (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2670">#2670</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/fdb1f7ea4abe128ae4e59e3d063fd95d7daaa964"><code>fdb1f7e</code></a> PYTHON-5677 Prevent ClientEncryption from loading crypt shared library (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2659">#2659</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/0cd9763423b85cd37779ea934bf7b1f8be8bbf8e"><code>0cd9763</code></a> Bump zizmorcore/zizmor-action from cb3d8e846e148d1111d90b03375b9c03deceda37 t...</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/2f263d4d3f11eb4a2b32ace467fd2767c371f4d7"><code>2f263d4</code></a> PYTHON-5680 Fix handling of expectedDocuments in Unified Test Runner (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2665">#2665</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/e9658b2406232b6bd6ac1d961b368142f8819479"><code>e9658b2</code></a> Add 4.15.5 release date to changelog (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2666">#2666</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/10dd20405ba19c643a1b305ff84f742b19c40daf"><code>10dd204</code></a> Update coverage[toml] requirement from <=7.10.6,>=5 to >=5,<=7.10.7 (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2662">#2662</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/130067799cc671d4dcc2f34dafff73c4ef5ddeaf"><code>1300677</code></a> [Spec Resync] 12-22-2025 (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2663">#2663</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/18c1f142b5b3fd179a677b2736332dc17770b7c2"><code>18c1f14</code></a> PYTHON-5529 Introduce optin setting to await for MinPoolSize population (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2664">#2664</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mongodb/mongo-python-driver/compare/4.8.0...4.16.0">compare view</a></li> </ul> </details> <br /> You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: moonbox3 <[email protected]> |
||
|
dependabot[bot]andwestey
|
445fd0ea53 |
.Net: Bump Aspire.Azure.Search.Documents from 9.5.1 to 13.3.0 (#13994)
Updated [Aspire.Azure.Search.Documents](https://github.com/microsoft/aspire) from 9.5.1 to 13.3.0. <details> <summary>Release notes</summary> _Sourced from [Aspire.Azure.Search.Documents's releases](https://github.com/microsoft/aspire/releases)._ ## 13.3.0 # Aspire 13.3.0 Aspire 13.3 is here! 🚀 This release is packed with new ways to deploy, debug, and build distributed apps — including `aspire destroy`, browser telemetry in the dashboard, Kubernetes deployment, first-class JavaScript publishing, and major TypeScript AppHost parity improvements. ## Highlights - 🧹 **Clean teardown** — New **`aspire destroy`** tears down Azure, Kubernetes, and Docker Compose deployments, and pipeline summaries make deploy/publish/destroy runs easier to follow. - 🔍 **Frontend telemetry** — **Aspire.Hosting.Browsers** captures browser console logs, network requests, and screenshots right in the Aspire dashboard. - ☸️ **Kubernetes deploy preview** — **`aspire deploy`** can now generate Helm-based Kubernetes deployments, with first-class Ingress and Gateway API routing. - 🟨 **JavaScript publishing** — New **`PublishAs*`** methods support static sites, Node servers, npm-script apps, Next.js, Vite, Bun, Yarn, and pnpm. - 🌐 **TypeScript AppHost parity** — Unified `withEnvironment`, Docker Compose hooks, endpoint expressions, Azure Container Apps domains, and more close the gap with C# AppHosts. - 🛠️ **CLI upgrades** — Run the standalone dashboard with **`aspire dashboard run`**, install the CLI as a NativeAOT `dotnet tool`, and search API docs from the terminal. - ☁️ **Azure goodness** — New Azure Front Door, Network Security Perimeter, AKS, private endpoint, and Foundry Prompt Agent support. - 🐳 **Better containers** — The Aspire container tunnel is now enabled by default for consistent host connectivity across Docker Desktop, Docker Engine, and Podman. ## ⚠️ Breaking changes Notable breaking changes include `--log-level` becoming `--pipeline-log-level`, the dashboard MCP server being replaced by `aspire agent init`, `dotnet new aspire-py-starter` moving to `aspire new aspire-py-starter`, and several API shape updates across AKS, Foundry, JavaScript diagnostics, and TypeScript AppHost helpers. See the full list in the [Aspire 13.3 breaking changes](https://aspire.dev/whats-new/aspire-13-3/#%EF%B8%8F-breaking-changes). ## 📖 Learn more For the full details, examples, migration guidance, and everything new in this release, check out [What's new in Aspire 13.3](https://aspire.dev/whats-new/aspire-13-3/). Thank you to all the community contributors who helped make Aspire 13.3 possible! 💜 ## 13.2.4 # Aspire 13.2.4 ## What's New in Aspire 13.2.4 Patch release addressing a security advisory in OpenTelemetry dependencies. ### 🐛 Fixes - 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#16420) ### 🏷️ Housekeeping - 🚀 Bumped branding to 13.2.4 (#16436) ## 13.2.3 # What's New in Aspire 13.2.3 Patch release focused on CLI packaging, signing, and reliability fixes. ## 🐛 Fixes - 🛑 aspire stop now properly cleans up application containers on Windows (#16123) - 🔐 Fixed macOS signing, permissions, and certificate trust with improved CI verification (#16053) - ✍️ Fixed signing for the aspire-managed bundle payload (#16211) - 🎭 Fixed Playwright CLI provenance verification for the new tag format (#16134) - 🧭 Updated service discovery environment variables (#16223) ## 🔧 Improvements - 📊 Removed telemetry API data limits and refactored URL builders (#16023) - ⏱️ Increased native build + sign timeout to 60 minutes for reliability (#16212) ## 🏷️ Housekeeping - 🔖 Bumped branding to 13.2.3 (#16181) - 🧪 Temporarily disabled Verify CLI archive step on Windows while investigating (#16276, #16285) ## 13.2.2 This is a servicing release focused on bug fixes and platform improvements. 🐛 Bug Fixes - Fix SqlClient runtime asset layout on Unix — Resolved an issue where Microsoft.Data.SqlClient failed to load correctly on macOS and Linux due to incorrect NuGet asset layout (#15709) - Fix IDE execution regressions for Azure Functions and class library projects — Backported fixes for 13.2 regressions impacting IDE-based execution (#15714) - Fix NpmRunner multi-version output parsing — npm view returning multiple versions no longer breaks version resolution; also bumps @playwright/cli to >=0.1.3 (#15746) - Skip name validation for internal resources — ProjectRebuilderResource, installer, and venv creator resources no longer fail the 64-char name limit since they're never deployed (#15726, fixes #15693) 🔒 Security & Certificates - Use ASP.NET Core dev cert for DCP — Avoids ephemeral certificate trust issues by using the standard ASP.NET Core developer certificate (#15718) - Cache PFX dev certs on Windows and Linux — Prevents binary-level changes between runs for persistent container scenarios (#15774) 🏗️ Infrastructure & Platform - ARM64 CLI support — Added win-arm64 and linux-arm64 to the native CLI archive build matrix (#15599) - Update DCP to 0.22.11 (#15713) 💻 CLI Improvements - Show anonymous dashboard URLs in aspire ps — The dashboard URL is now displayed even when running without authentication (#15731 ## 13.2.1 🐛 Bug Fixes - 🖥️ CLI bundles for ARM & musl — win-arm64, linux-arm64, and linux-musl-x64 bundles now correctly include DCP instead of silently producing broken installs (#15529) - ⚡ aspire new in VS Code — Fixed a race where the workspace switch severed the CLI terminal before the agent init prompt could complete (#15553) - 🔗 Dashboard resource URLs — The describe command no longer produces broken dashboard links with a stray /login?t=... in the path (#15495) - 🌍 Guest AppHost env vars — Launch profile environment variables are now correctly forwarded to guest AppHosts (#15637) - 📦 Legacy settings migration — .aspire/settings.json → aspire.config.json migration was silently skipped in some scenarios; now works reliably (#15526) - 🔧 TypeScript AppHost restore — Fixed config resolution during TS AppHost restore (#15625) - 🎭 Playwright CLI on Windows — aspire agent init now correctly installs playwright-cli on Windows (#15559) - 📌 Emulator stability — Pinned Kusto emulator image and improved Cosmos DB emulator reliability (#15504) ✨ Improvements - 🏗️ Brownfield TypeScript aspire init — Running aspire init in existing JS/TS projects now smartly merges package.json — scripts, dependencies, and engines — with semver-aware conflict handling (#15123) - 🎯 Endpoint filtering — New ExcludeReferenceEndpoint property lets you filter specific endpoints from WithReference (#15586) - 🌐 More polyglot ATS APIs — Exported additional hosting APIs for TypeScript and Go AppHost authoring (#15557) - 🔍 Short trace ID support — The dashboard now resolves short trace IDs in addition to full-length ones (#15613) - ⚠️ Aspire.Hosting.NodeJs deprecated — Use Aspire.Hosting.JavaScript instead; the old package no longer appears in aspire add (#15686) ## 13.2.0 # Aspire 13.2 Aspire 13.2 brings major CLI enhancements, a new TypeScript AppHost (preview), dashboard data export/import, Microsoft Foundry integration, and multi-language improvements — all focused on making local development more streamlined for developers and AI coding agents alike. ## Highlights - 🛠️ CLI overhaul — New commands including **aspire start/stop/ps** for detached mode, **aspire describe** for resource monitoring, **aspire doctor** for environment diagnostics, **aspire secret** for managing user secrets, **aspire docs** for browsing documentation from the terminal, and **aspire agent** (renamed from **aspire mcp**) for AI agent integration. - 🌐 TypeScript AppHost (preview) — Write your apphost in TypeScript with **createBuilder()**, using the same app model concepts as C#. Full VS Code extension support included. - 🧩 VS Code extension — Dedicated Aspire Activity Bar panel with live resource state, inline CodeLens with health status and actions, gutter decorations, and a new Getting Started walkthrough. - 📊 Dashboard improvements — Bulk telemetry export/import, export environment variables as **.env** files, a new telemetry HTTP API, set parameters directly from the dashboard, and improved resource graph layout. - 🤖 Microsoft Foundry — Replaces Azure AI Foundry integration with broader **Aspire.Hosting.Foundry** support including hosted agents and model deployments. - 🔒 Azure Virtual Network & Private Endpoints — New **Aspire.Hosting.Azure.Network** integration for defining VNets, subnets, NAT gateways, NSGs, and private endpoints directly in your apphost. - 🐳 Docker Compose publishing — Generate docker-compose.yaml from your app model with **AddDockerComposeEnvironment.** - 📦 New integrations — Azure Data Lake Storage, MongoDB EF Core (**Aspire.MongoDB.EntityFrameworkCore**), Bun support for JS resources, and Certbot for automated SSL certificates. - ⚡ App model — **WithMcpServer** for declaring MCP endpoints, **rebuild** command for project resources, contextual endpoint resolution, and improved secret/certificate handling. ## ⚠️ Breaking changes Notable breaking changes include service discovery env vars now using endpoint scheme instead of name, aspire.config.json replacing split config files, AIFoundry → Foundry rename, WithSecretBuildArg → WithBuildSecret, and updated default Azure credential behavior. [See the full list of breaking changes](https://aspire.dev/whats-new/aspire-13-2/#%EF%B8%8F-breaking-changes). ## 📖 Learn more For the full details on everything in this release, check out the [What's new in Aspire 13.2](https://aspire.dev/whats-new/aspire-13-2/) documentation. Thank you to all the community contributors who helped make this release happen! 💜 ## 13.1.3 ## What's Changed * [release/13.1] Add installer publishing updates for 13.1.3 by @radical in https://github.com/dotnet/aspire/pull/15158 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.2...v13.1.3 ## 13.1.2 ## What's Changed * Bump patch version from 13.1.1 to 13.1.2 by @Copilot in https://github.com/dotnet/aspire/pull/14699 * [release/13.1] Fix template version parsing for .NET 10.0 SDK separator change by @JamesNK in https://github.com/dotnet/aspire/pull/14698 * Update pipeline images to non-deprecated pools by @joperezr in https://github.com/dotnet/aspire/pull/14707 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.1...v13.1.2 ## 13.1.1 ## What's Changed * [release/13.1] Ensure WithHostHttpsPort works when chained inline by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13678 * [release/13.1] Escape backslashes in path string to discovered vite config by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13822 * [release/13.1] [Testing] Fixing bugs for sticky slot app settings by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13810 * [release/13.1] Fix AzureBicepResource file-not-found error when using templateFile with AzurePublishingContext by @github-actions[bot] in https://github.com/dotnet/aspire/pull/14018 * [release/13.1] Filter dev certs without X509SubjectKeyIdentifierExtension when any cert has it by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13676 * [release/13.1] Fix Aspire.ProjectTemplates build failure from command line length limits by @github-actions[bot] in https://github.com/dotnet/aspire/pull/14009 * [release/13.1] Update Azure.Identity package version to 1.17.1 by @eerhardt in https://github.com/dotnet/aspire/pull/14251 * Bump patch version from 13.1.0 to 13.1.1 by @Copilot in https://github.com/dotnet/aspire/pull/14329 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.0...v13.1.1 ## 13.1.0 We are excited to share that our 13.1.0 release of Aspire has shipped! All of the packages are available in NuGet.org now. Head over to https://aspire.dev/whats-new/aspire-13-1/ to find what's new in 13.1.0! ## What's Changed * Target net10.0 in client integrations by @eerhardt in https://github.com/dotnet/aspire/pull/12500 * Fix DockerComposeEnvironment duplicating image names in .env file by @Copilot in https://github.com/dotnet/aspire/pull/12310 * Replace apt-get with npm for Azure Functions Core Tools installation by @Copilot in https://github.com/dotnet/aspire/pull/12537 * Improve flaky dashboard integration test by @JamesNK in https://github.com/dotnet/aspire/pull/12534 * Add README.md for the Aspire.Hosting.Azure.AppService package by @ShilpiRach in https://github.com/dotnet/aspire/pull/12528 * Add support to enable automatic scaling for App Service Environment by @ShilpiRach in https://github.com/dotnet/aspire/pull/12305 * Update to FluentUI 4.13.1 by @JamesNK in https://github.com/dotnet/aspire/pull/12532 * Skip playground projects in build-packages workflow by @Copilot in https://github.com/dotnet/aspire/pull/12547 * Allow HostUrl to remap both address and port by @danegsta in https://github.com/dotnet/aspire/pull/12521 * Refactor NodeJs Integration by @eerhardt in https://github.com/dotnet/aspire/pull/12530 * Fix MCP endpoint with redirect HTTPS by @JamesNK in https://github.com/dotnet/aspire/pull/12556 * [main] Update dependencies from microsoft/usvc-apiserver by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12540 * Refactor AddNodeApp by @eerhardt in https://github.com/dotnet/aspire/pull/12538 * Update Aspire branding from 13.0 to 13.1 by @Copilot in https://github.com/dotnet/aspire/pull/12527 * Add annotation to specify custom base images for generated Dockerfiles by @Copilot in https://github.com/dotnet/aspire/pull/12566 * Fix generating random MCP endpoint URL in templates by @JamesNK in https://github.com/dotnet/aspire/pull/12558 * [CI] Add new Agent for disabling or quarantining tests by @radical in https://github.com/dotnet/aspire/pull/12570 * Add `ExcludeFromMcp()` resource extension by @JamesNK in https://github.com/dotnet/aspire/pull/12515 * Localized file check-in by OneLocBuild Task: Build definition ID 1309: Build ID 2828818 by @dotnet-bot in https://github.com/dotnet/aspire/pull/12546 * Register IPipelineOutputService in DI for pipeline output directory management by @Copilot in https://github.com/dotnet/aspire/pull/12563 * Add deploy support for Docker Compose by @captainsafia in https://github.com/dotnet/aspire/pull/12548 * Quarantine flaky test: AzureServiceBusEmulatorResourceGeneratesConfigJsonWithCustomizations by @Copilot in https://github.com/dotnet/aspire/pull/12578 * Update connection properties for non-Azure resources by @sebastienros in https://github.com/dotnet/aspire/pull/12583 * Filter to highest package version per channel in aspire add command by @Copilot in https://github.com/dotnet/aspire/pull/12553 * Log DCP messages at Debug/Trace level in AppHost by @Copilot in https://github.com/dotnet/aspire/pull/12533 * Add CLI self-update prompts to `aspire update` command by @Copilot in https://github.com/dotnet/aspire/pull/12395 * Fix golang and alpine images. by @mitchdenny in https://github.com/dotnet/aspire/pull/12592 * Replace ContainerTargetPlatform.AllLinux with LinuxAmd64 by @Copilot in https://github.com/dotnet/aspire/pull/12596 * [main] Update dependencies from microsoft/usvc-apiserver by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12610 * Make IReportingStep and IReportingTask completion idempotent by @Copilot in https://github.com/dotnet/aspire/pull/12602 * Show --log-level debug hint when pipeline fails by @Copilot in https://github.com/dotnet/aspire/pull/12603 * [main] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12622 * Rename app.py to main.py in template by @eerhardt in https://github.com/dotnet/aspire/pull/12628 * bump extension version by @adamint in https://github.com/dotnet/aspire/pull/12623 * don't build apphost in cli when running in extension by @adamint in https://github.com/dotnet/aspire/pull/12621 * Detect which version of yarn is being used by @eerhardt in https://github.com/dotnet/aspire/pull/12633 * Fix duplicate key exception when using WithExplicitStart() on resources with environment callbacks by @Copilot in https://github.com/dotnet/aspire/pull/12604 * Support AddCSharpApp, fix some rough edges around project resources by @adamint in https://github.com/dotnet/aspire/pull/12568 * Add missing namespace to `CertificateAuthorityCollectionResource` by @danegsta in https://github.com/dotnet/aspire/pull/12639 * Add ModelContextProtocol assemblies to signing list by @joperezr in https://github.com/dotnet/aspire/pull/12637 * Generate fallback Dockerfile for Python apps without UV by @Copilot in https://github.com/dotnet/aspire/pull/12627 * Update/bump container image tags for hosting components by @joperezr in https://github.com/dotnet/aspire/pull/12459 * Mark IDeveloperCertificateService experimental by @danegsta in https://github.com/dotnet/aspire/pull/12648 * Wait with exponential backoff for expected Executables by @karolz-ms in https://github.com/dotnet/aspire/pull/12647 * Make ProcessCertificateTrustConfigAsync internal by @danegsta in https://github.com/dotnet/aspire/pull/12649 * Add test cases and ensure container cert override paths work by @danegsta in https://github.com/dotnet/aspire/pull/12654 * Python hosting: Support .venv lookup by walking up parent directories by @Copilot in https://github.com/dotnet/aspire/pull/12616 ... (truncated) ## 13.0.2 This patch is updating our Project Templates for our Python starter app to ensure we depend on the latest version of React. This is out of an abundance of caution, as we don't depend on any of the react packages that were flagged as vulnerable in https://github.com/advisories/GHSA-fv66-9v8q-g76r. ## What's Changed * Bump patch version from 13.0.1 to 13.0.2 by @Copilot in https://github.com/dotnet/aspire/pull/13324 * Update React and ReactDOM to version 19.2.1 across all projects by @joperezr in https://github.com/dotnet/aspire/pull/13325 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.0.1...v13.0.2 ## 13.0.1 ## What's Changed * Merge internal changes by @joperezr in https://github.com/dotnet/aspire/pull/12896 * [release/13.0] Fix Azure roles resources always redeploying by @github-actions[bot] in https://github.com/dotnet/aspire/pull/12903 * [release/13.0] Remove .py and .js files from being signed (#13005) by @eerhardt in https://github.com/dotnet/aspire/pull/13032 * [release/13.0] Fix subscription ID not being disabled on Azure provisioning dialog by @github-actions[bot] in https://github.com/dotnet/aspire/pull/12913 * [release/13.0] Default OpenAISettings.EnableSensitiveTelemetryData to TelemetryHelpers.EnableSensitiveDataDefault by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13017 * Bump patch version from 13.0.0 to 13.0.1 by @Copilot in https://github.com/dotnet/aspire/pull/13167 * [release/13.0] EndpointReference evaluation should wait on missing AllocatedEndpoint (#13074) by @karolz-ms in https://github.com/dotnet/aspire/pull/13076 * [release/13.0] Update to Npgsql 10 by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13166 * [release/13.0] Update dependencies from microsoft/usvc-apiserver by @danegsta in https://github.com/dotnet/aspire/pull/13187 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.0.0...v13.0.1 ## 13.0.0 We are excited to share that our 13.0.0 release of Aspire has shipped! All of the packages are available in NuGet.org now. Head over to https://aspire.dev/whats-new/aspire-13/ to find what's new in 13.0.0! ## New Contributors * @jomaxso made their first contribution in https://github.com/dotnet/aspire/pull/11840 * @jguadagno made their first contribution in https://github.com/dotnet/aspire/pull/11876 * @foxminchan made their first contribution in https://github.com/dotnet/aspire/pull/11700 * @yreynhout made their first contribution in https://github.com/dotnet/aspire/pull/12087 **Full Changelog**: https://github.com/dotnet/aspire/compare/v9.5.0...v13.0.0 ## 9.5.2 ## What's Changed * [release/9.5] Revert SQL Server container image tag from 2025-latest to 2022-latest for Mac ARM compatibility by @github-actions[bot] in https://github.com/dotnet/aspire/pull/11908 * [release/9.5] Ensure OutputPath is created in ResourceContainerImageBuilder by @github-actions[bot] in https://github.com/dotnet/aspire/pull/11886 * [release/9.5] Add configuration to suppress unsecured telemetry message in dashboard by @github-actions[bot] in https://github.com/dotnet/aspire/pull/11954 * [release/9.5] Update dependencies from https://github.com/microsoft/usvc-apiserver build 0.17.3 by @danegsta in https://github.com/dotnet/aspire/pull/12032 * [release/9.5] Multi-target RabbitMQ and Redis client libraries by @eerhardt in https://github.com/dotnet/aspire/pull/12138 * Backport PR #11951: Add noProfileSwitch to run command in DotNetCliRunner by @Copilot in https://github.com/dotnet/aspire/pull/11959 * Bump patch version to 9.5.2 by @Copilot in https://github.com/dotnet/aspire/pull/12139 **Full Changelog**: https://github.com/dotnet/aspire/compare/v9.5.1...v9.5.2 Commits viewable in [compare view](https://github.com/microsoft/aspire/compare/v9.5.1...v13.3.0). </details> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: westey <[email protected]> |
||
|
dependabot[bot]
|
367c75f4ff |
.Net: Bump minimatch from 3.1.2 to 3.1.5 in /dotnet/samples/Demos/ProcessWithCloudEvents/ProcessWithCloudEvents.Client (#13604)
Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.2 to 3.1.5. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/isaacs/minimatch/commit/7bba97888a27a6162983056bcce2a6e28f668712"><code>7bba978</code></a> 3.1.5</li> <li><a href="https://github.com/isaacs/minimatch/commit/bd259425b2ca17b42897997f93e890314155522d"><code>bd25942</code></a> docs: add warning about ReDoS</li> <li><a href="https://github.com/isaacs/minimatch/commit/1a9c27c75725474dbde57db2995b6281b267756d"><code>1a9c27c</code></a> fix partial matching of globstar patterns</li> <li><a href="https://github.com/isaacs/minimatch/commit/1a2e084af579731af66c221214e3ca8222c9bf23"><code>1a2e084</code></a> 3.1.4</li> <li><a href="https://github.com/isaacs/minimatch/commit/ae24656237c3d58067442f790ce17eff84463a47"><code>ae24656</code></a> update lockfile</li> <li><a href="https://github.com/isaacs/minimatch/commit/b1003749228b2a79e1f237963a0d559ef7a0941e"><code>b100374</code></a> limit recursion for **, improve perf considerably</li> <li><a href="https://github.com/isaacs/minimatch/commit/26ffeaa091b9f660833e23f42e07165b33e85c13"><code>26ffeaa</code></a> lockfile update</li> <li><a href="https://github.com/isaacs/minimatch/commit/9eca892a4e5dbb20534f9f30483b85cdeee6c2eb"><code>9eca892</code></a> lock node version to 14</li> <li><a href="https://github.com/isaacs/minimatch/commit/00c323b188b704e5d4bc534ecec2268cfa70a32a"><code>00c323b</code></a> 3.1.3</li> <li><a href="https://github.com/isaacs/minimatch/commit/30486b2048929264f44d18822891cfffa02af78b"><code>30486b2</code></a> update CI matrix and actions</li> <li>Additional commits viewable in <a href="https://github.com/isaacs/minimatch/compare/v3.1.2...v3.1.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]andcopilot-swe-agent[bot]
|
356aed0986 |
Python: Bump starlette from 0.52.1 to 1.3.1 in /python (#14092)
Bumps [starlette](https://github.com/Kludex/starlette) from 0.52.1 to 1.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p> <blockquote> <h2>Version 1.3.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>StarletteDeprecationWarning</code> instead of <code>DeprecationWarning</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3119">Kludex/starlette#3119</a></li> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3329">Kludex/starlette#3329</a></li> <li>Enforce <code>FormParser</code> limits in parser callbacks by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3331">Kludex/starlette#3331</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.3.0...1.3.1">https://github.com/Kludex/starlette/compare/1.3.0...1.3.1</a></p> <h2>Version 1.3.0</h2> <h2>What's Changed</h2> <ul> <li>Clamp oversized suffix ranges in <code>FileResponse</code> by <a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files by <a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li>Add <code>httpx2</code> to the <code>full</code> extra by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3323">Kludex/starlette#3323</a></li> <li>Adjust testclient typing and warnings by <a href="https://github.com/waketzheng"><code>@waketzheng</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3322">Kludex/starlette#3322</a></li> <li>Fix IndexError in URL.replace() on a URL with no authority by <a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li>Annotate URLPath protocol parameter with Literal by <a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li>avoid collapsing exception groups from user code by <a href="https://github.com/graingert"><code>@graingert</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/2830">Kludex/starlette#2830</a></li> <li>Use <code>removeprefix</code> to strip weak ETag indicator in <code>is_not_modified</code> by <a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> <li>Build <code>request.url</code> from structured components by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3326">Kludex/starlette#3326</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li><a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li><a href="https://github.com/leestana01"><code>@leestana01</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3319">Kludex/starlette#3319</a></li> <li><a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li><a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3204">Kludex/starlette#3204</a></li> <li><a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li><a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.1...1.3.0">https://github.com/Kludex/starlette/compare/1.2.1...1.3.0</a></p> <h2>Version 1.2.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module by <a href="https://github.com/leifwar"><code>@leifwar</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li>Add assert error for requires() when request param is not Request type by <a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/leifwar"><code>@leifwar</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li><a href="https://github.com/diskeu"><code>@diskeu</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3243">Kludex/starlette#3243</a></li> <li><a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.0...1.2.1">https://github.com/Kludex/starlette/compare/1.2.0...1.2.1</a></p> <h2>Version 1.2.0</h2> <h2>What's Changed</h2> <ul> <li>Support httpx2 in the test client by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3291">Kludex/starlette#3291</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.1.0...1.2.0">https://github.com/Kludex/starlette/compare/1.1.0...1.2.0</a></p> <h2>Version 1.1.0</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p> <blockquote> <h2>1.3.1 (June 12, 2026)</h2> <h4>Fixed</h4> <ul> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> <a href="https://redirect.github.com/encode/starlette/pull/3329">#3329</a>.</li> <li>Enforce <code>FormParser</code> limits in parser callbacks <a href="https://redirect.github.com/encode/starlette/pull/3331">#3331</a>.</li> </ul> <h2>1.3.0 (June 11, 2026)</h2> <h4>Added</h4> <ul> <li>Add <code>httpx2</code> to the <code>full</code> extra <a href="https://redirect.github.com/encode/starlette/pull/3323">#3323</a>.</li> <li>Annotate the <code>URLPath</code> <code>protocol</code> parameter with <code>Literal</code> <a href="https://redirect.github.com/encode/starlette/pull/3285">#3285</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Build <code>request.url</code> from structured components <a href="https://redirect.github.com/encode/starlette/pull/3326">#3326</a>.</li> <li>Clamp oversized suffix ranges in <code>FileResponse</code> <a href="https://redirect.github.com/encode/starlette/pull/3307">#3307</a>.</li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files <a href="https://redirect.github.com/encode/starlette/pull/3191">#3191</a>.</li> <li>Avoid collapsing exception groups raised from user code <a href="https://redirect.github.com/encode/starlette/pull/2830">#2830</a>.</li> <li>Use <code>removeprefix</code> to strip the weak <code>ETag</code> indicator in <code>is_not_modified</code> <a href="https://redirect.github.com/encode/starlette/pull/3193">#3193</a>.</li> <li>Fix <code>IndexError</code> in <code>URL.replace()</code> on a URL with no authority <a href="https://redirect.github.com/encode/starlette/pull/3317">#3317</a>.</li> <li>Adjust <code>testclient</code> typing and warnings <a href="https://redirect.github.com/encode/starlette/pull/3322">#3322</a>.</li> </ul> <h2>1.2.1 (May 31, 2026)</h2> <h4>Fixed</h4> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module <a href="https://redirect.github.com/encode/starlette/pull/3304">#3304</a>.</li> <li>Add assert error for <code>requires()</code> when the request parameter is not a <code>Request</code> type <a href="https://redirect.github.com/encode/starlette/pull/3298">#3298</a>.</li> </ul> <h2>1.2.0 (May 28, 2026)</h2> <h4>Added</h4> <ul> <li>Support httpx2 in the test client <a href="https://redirect.github.com/encode/starlette/pull/3291">#3291</a>.</li> </ul> <h2>1.1.0 (May 23, 2026)</h2> <h4>Added</h4> <ul> <li>Use <code>"application/octet-stream"</code> as the <code>FileResponse</code> media type fallback <a href="https://redirect.github.com/encode/starlette/pull/3283">#3283</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Only dispatch standard HTTP verbs in <code>HTTPEndpoint</code> <a href="https://redirect.github.com/encode/starlette/pull/3286">#3286</a>.</li> <li>Reject absolute paths in <code>StaticFiles.lookup_path</code> <a href="https://redirect.github.com/encode/starlette/pull/3287">#3287</a>.</li> </ul> <h2>1.0.1 (May 21, 2026)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Kludex/starlette/commit/8ebffd0678570ddd5d5bb11c6f3c3c7fd4682ab9"><code>8ebffd0</code></a> Version 1.3.1 (<a href="https://redirect.github.com/Kludex/starlette/issues/3330">#3330</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/25b8e179d8d7ed86769c02f648772dd5fb43dc3c"><code>25b8e17</code></a> Enforce <code>FormParser</code> limits in parser callbacks (<a href="https://redirect.github.com/Kludex/starlette/issues/3331">#3331</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/dba1c4babc4f99ad2622bb913d87045775dda735"><code>dba1c4b</code></a> Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3329">#3329</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/45e51dcf99f3a270b0bcec1aec5410b4345863a9"><code>45e51dc</code></a> Use <code>StarletteDeprecationWarning</code> instead of <code>DeprecationWarning</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3119">#3119</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/5f8610c386e13de1d80d36efa961e1486a1d2d01"><code>5f8610c</code></a> Version 1.3.0 (<a href="https://redirect.github.com/Kludex/starlette/issues/3327">#3327</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/167b5850e809f38b27fbfed62d58bf6442855975"><code>167b585</code></a> Build <code>request.url</code> from structured components (<a href="https://redirect.github.com/Kludex/starlette/issues/3326">#3326</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/37309255b4c1b9c381a2d24a1eaf83100984a16a"><code>3730925</code></a> Use <code>removeprefix</code> to strip weak ETag indicator in <code>is_not_modified</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3193">#3193</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/e6f7ad1ab85efb27ab7910d8007b3f4531f7b083"><code>e6f7ad1</code></a> avoid collapsing exception groups from user code (<a href="https://redirect.github.com/Kludex/starlette/issues/2830">#2830</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/115228fcdca0e0ef5bf4a95a40ddce5a9fced428"><code>115228f</code></a> Annotate URLPath protocol parameter with Literal (<a href="https://redirect.github.com/Kludex/starlette/issues/3285">#3285</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/113f193a34353c9153857028c1074351d22fad07"><code>113f193</code></a> docs: replace inline ASGI server list with link to canonical implemen… (<a href="https://redirect.github.com/Kludex/starlette/issues/3204">#3204</a>)</li> <li>Additional commits viewable in <a href="https://github.com/Kludex/starlette/compare/0.52.1...1.3.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> |
||
|
dependabot[bot]
|
6209c77fd5 |
.Net: Bump @babel/core from 7.26.10 to 7.29.7 in /dotnet/samples/Demos/ProcessWithCloudEvents/ProcessWithCloudEvents.Client (#14083)
Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.26.10 to 7.29.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/babel/babel/releases">@babel/core's releases</a>.</em></p> <blockquote> <h2>v7.29.7 (2026-05-25)</h2> <p>Re-release all packages with npm provenance attestations</p> <h2>v7.29.6 (2026-05-25)</h2> <h4>🐛 Bug Fix</h4> <ul> <li><code>babel-generator</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/18014">#18014</a> Catchup source map position in preserveFormat (<a href="https://github.com/nicolo-ribaudo"><code>@nicolo-ribaudo</code></a>)</li> </ul> </li> <li><code>babel-core</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/18001">#18001</a> [7.x packport]Improve input source map handling (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> <li><code>babel-core</code>, <code>babel-generator</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17998">#17998</a> Preserve original identifier names from input sourcemaps (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/17992">#17992</a>) (<a href="https://github.com/Andarist"><code>@Andarist</code></a>)</li> </ul> </li> </ul> <h4>Committers: 3</h4> <ul> <li>Huáng Jùnliàng (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> <li>Mateusz Burzyński (<a href="https://github.com/Andarist"><code>@Andarist</code></a>)</li> <li>Nicolò Ribaudo (<a href="https://github.com/nicolo-ribaudo"><code>@nicolo-ribaudo</code></a>)</li> </ul> <h2>v7.29.5 (2026-05-05)</h2> <h4>🏠 Internal</h4> <ul> <li><code>babel-preset-env</code> <ul> <li>Update <code>@babel/*</code> dependencies</li> </ul> </li> </ul> <h2>v7.29.4 (2026-05-05)</h2> <h4>🐛 Bug Fix</h4> <ul> <li><code>babel-plugin-transform-modules-systemjs</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17974">#17974</a> [7.x backport]fix(systemjs): improve module string name support (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> </ul> <h4>Committers: 1</h4> <ul> <li>Huáng Jùnliàng (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> <h2>v7.29.3 (2026-04-30)</h2> <h4>👓 Spec Compliance</h4> <ul> <li><code>babel-parser</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17923">#17923</a> Support flow extends bound (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> </ul> <h4>🐛 Bug Fix</h4> <ul> <li><code>babel-helper-create-class-features-plugin</code>, <code>babel-plugin-proposal-decorators</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17931">#17931</a> fix(decorators): replace super within all removed static elements (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> <li><code>babel-register</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17915">#17915</a> Fix thread synchronization issues in <code>@babel/register</code> (<a href="https://github.com/liuxingbaoyu"><code>@liuxingbaoyu</code></a>)</li> </ul> </li> <li><code>babel-compat-data</code>, <code>babel-plugin-bugfix-safari-rest-destructuring-rhs-array</code>, <code>babel-preset-env</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17788">#17788</a> Add bugfix plugin for Safari array rest destructuring bug (<a href="https://github.com/JLHwung"><code>@JLHwung</code></a>)</li> </ul> </li> </ul> <h4>💅 Polish</h4> <ul> <li><code>babel-parser</code></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/babel/babel/commit/4fba7541180bf5f58256d8e358b544e3831ad090"><code>4fba754</code></a> v7.29.7</li> <li><a href="https://github.com/babel/babel/commit/04ea6b27fdac8f40c3481aec2080ac9678779509"><code>04ea6b2</code></a> v7.29.6</li> <li><a href="https://github.com/babel/babel/commit/99f498a9b9fa0b900d603fbe8f6601bb3b9e42bb"><code>99f498a</code></a> [7.x packport]Improve input source map handling (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/18001">#18001</a>)</li> <li><a href="https://github.com/babel/babel/commit/feba0a3654c596bd369d1ef1231f5d56666d56dc"><code>feba0a3</code></a> Preserve original identifier names from input sourcemaps (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/17992">#17992</a>) (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/17998">#17998</a>)</li> <li><a href="https://github.com/babel/babel/commit/aa8394e454337d118ac3d40bfa3ee1a3cb3f3ed2"><code>aa8394e</code></a> v7.29.0</li> <li><a href="https://github.com/babel/babel/commit/ad0d03f0c92404a60ec6b1c12f15febd38e2397a"><code>ad0d03f</code></a> [7.x backport] feat: Allow specifying startLine in code frame (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/17739">#17739</a>)</li> <li><a href="https://github.com/babel/babel/commit/d7f400889567ae18ef9ac41b024b5120f6060e17"><code>d7f4008</code></a> v7.28.6</li> <li><a href="https://github.com/babel/babel/commit/e130225028e93e106135586f344cfa44c4aac847"><code>e130225</code></a> Polish(standalone): improve message on invalid preset/plugin (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/17606">#17606</a>)</li> <li><a href="https://github.com/babel/babel/commit/99dcba5e71de3bd81ce14077cfa5b6df58e9b177"><code>99dcba5</code></a> chore: enable some ts-eslint rules (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/17592">#17592</a>)</li> <li><a href="https://github.com/babel/babel/commit/c92c4919771105140015167f25f7bacac77c90d9"><code>c92c491</code></a> Improve Unicode handling in code-frame tokenizer (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/17589">#17589</a>)</li> <li>Additional commits viewable in <a href="https://github.com/babel/babel/commits/v7.29.7/packages/babel-core">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@babel/core</code> since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
51748eecf3 |
Python: Bump pyjwt from 2.11.0 to 2.13.0 in /python (#14084)
Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.11.0 to 2.13.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.13.0</h2> <h1>PyJWT 2.13.0 — Security Release</h1> <p>This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.</p> <h2>Security</h2> <ul> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"><code>GHSA-xgmm-8j9v-c9wx</code></a> — JWK JSON accepted as HMAC secret (algorithm confusion).</strong> <code>HMACAlgorithm.prepare_key</code> previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in <code>algorithms=[…]</code> and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. <em>Reported by <a href="https://github.com/aradona91"><code>@aradona91</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f"><code>GHSA-jq35-7prp-9v3f</code></a> — Algorithm allow-list bypass with <code>PyJWK</code> / <code>PyJWKClient</code>.</strong> When verifying with a <code>PyJWK</code>, the caller's <code>algorithms=[…]</code> allow-list was checked against the token header <code>alg</code> as a string only; actual verification used the algorithm bound to the <code>PyJWK</code>. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header <code>alg</code> to match the <code>PyJWK</code>'s algorithm before verification. <em>Reported by <a href="https://github.com/sushi-gif"><code>@sushi-gif</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39"><code>GHSA-w7vc-732c-9m39</code></a> — DoS via base64 decode of unused payload segment when <code>b64=false</code>.</strong> For detached-payload JWS (<code>b64=false</code>), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied <code>detached_payload</code>. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. <em>Reported by <a href="https://github.com/thesmartshadow"><code>@thesmartshadow</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4"><code>GHSA-993g-76c3-p5m4</code></a> — <code>PyJWKClient</code> accepts non-HTTP(S) URIs.</strong> <code>PyJWKClient.fetch_data</code> passed its URI to <code>urllib.request.urlopen</code>, which by default also handles <code>file://</code>, <code>ftp://</code>, and <code>data:</code> schemes. An application that fed an attacker-influenced URI into <code>PyJWKClient</code> could be coerced into reading local files or reaching other unintended schemes. <code>PyJWKClient</code> now rejects any URI whose scheme isn't <code>http</code> or <code>https</code>. <em>Reported by <a href="https://github.com/KEIJOT"><code>@KEIJOT</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8"><code>GHSA-fhv5-28vv-h8m8</code></a> — <code>PyJWKClient</code> cache wiped on fetch error.</strong> A <code>finally</code>-block <code>put(jwk_set=None)</code> cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. <em>Reported by <a href="https://github.com/eddieran"><code>@eddieran</code></a>.</em></p> </li> </ul> <h2>Fixed</h2> <ul> <li>Reject empty HMAC keys outright in <code>HMACAlgorithm.prepare_key</code> with <code>InvalidKeyError</code> instead of accepting them with only a warning. Defends against the <code>os.getenv("JWT_SECRET", "")</code> footgun. <em>Thanks to <a href="https://github.com/SnailSploit"><code>@SnailSploit</code></a> and <a href="https://github.com/spartan8806"><code>@spartan8806</code></a> for the reports.</em></li> <li>Forward per-call <code>options</code> (including <code>enforce_minimum_key_length</code>) from <code>PyJWT.decode</code> through to <code>PyJWS._verify_signature</code>. The option was previously silently dropped between the two layers, so it only took effect when set on the <code>PyJWT</code> instance. <em>Thanks to <a href="https://github.com/WLUB"><code>@WLUB</code></a> for the report.</em></li> <li><strong>RFC 7797 §3 compliance for <code>b64=false</code>:</strong> the encoder now auto-adds <code>"b64"</code> to <code>crit</code>, and the decoder rejects tokens that set <code>b64=false</code> without listing it in <code>crit</code>. <em>Thanks to <a href="https://github.com/MachineLearning-Nerd"><code>@MachineLearning-Nerd</code></a> for the report.</em></li> </ul> <h2>Changed</h2> <ul> <li>Migrate the <code>dev</code>, <code>docs</code>, and <code>tests</code> package extras to dependency groups, by <a href="https://github.com/kurtmckee"><code>@kurtmckee</code></a> in <a href="https://redirect.github.com/jpadilla/pyjwt/pull/1152">#1152</a>.</li> </ul> <h2>Upgrade notes</h2> <p>Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:</p> <ul> <li><strong>Empty HMAC keys now raise.</strong> If your app passed <code>""</code> or <code>b""</code> as a secret (often via a missing env var, e.g. <code>os.getenv("JWT_SECRET", "")</code>), <code>encode</code>/<code>decode</code> will now raise <code>InvalidKeyError</code>. This is the intended behavior — fix the configuration.</li> <li><strong><code>PyJWK</code> decoding now requires the token's <code>alg</code> to match the JWK's algorithm.</strong> Previously a mismatch was silently honored if the header <code>alg</code> appeared in the allow-list. Tokens that relied on this mismatch will now fail with <code>InvalidAlgorithmError</code>.</li> <li><strong><code>PyJWKClient</code> now rejects non-HTTP(S) URIs at construction time.</strong> Tests or dev environments that fetched JWKS from <code>file://</code> URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct <code>PyJWKSet.from_dict(...)</code> directly).</li> <li><strong><code>b64=false</code> tokens are now strictly RFC 7515 / 7797 compliant.</strong> Tokens with a non-empty compact-form payload segment, or that omit <code>"b64"</code> from <code>crit</code>, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.</li> <li><strong><code>enforce_minimum_key_length</code> set per-call now takes effect.</strong> Callers who passed <code>options={"enforce_minimum_key_length": True}</code> to <code>jwt.decode()</code> previously got no enforcement; they will now get <code>InvalidKeyError</code> on undersized keys, as documented.</li> </ul> <p><strong>Full changelog:</strong> <a href="https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0">https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0</a></p> <h2>2.12.1</h2> <h2>What's Changed</h2> <ul> <li>Add typing_extensions dependency for Python < 3.11 by <a href="https://github.com/jpadilla"><code>@jpadilla</code></a> in <a href="https://redirect.github.com/jpadilla/pyjwt/pull/1151">jpadilla/pyjwt#1151</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1">https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1</a></p> <h2>2.12.0</h2> <h2>Security</h2> <ul> <li>Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by <a href="https://github.com/dmbs335"><code>@dmbs335</code></a> in <a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f">GHSA-752w-5fwx-jx9f</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0></code>__</h2> <p>Security</p> <pre><code> - Reject JWK JSON documents passed as raw HMAC secrets in ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that the existing PEM/SSH guard did not cover. Reported by @aradona91 in `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__. - Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during verification so the caller's ``algorithms=[...]`` allow-list cannot be bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__. - Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker- influenced URIs cannot read local files or reach unintended schemes via urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__. - Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``. The previous ``finally``-block ``put(None)`` pattern cleared the cache on any transient outage, turning one bad JWKS request into application- wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__. - Skip the unconditional base64 decode of the compact-form payload segment when ``b64=false`` is set in the protected header, and require that segment to be empty (RFC 7515 Appendix F detached form). Closes an unauthenticated DoS amplifier. Reported by @thesmartshadow in `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__. <p>Fixed</p> <pre><code> - Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with ``InvalidKeyError`` instead of accepting them with only a warning. Thanks to @SnailSploit and @spartan8806 for independently flagging the footgun. - Forward per-call ``options`` (including ``enforce_minimum_key_length``) from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the option actually takes effect when set at the call site rather than only on the ``PyJWT`` instance. Thanks to @WLUB for the report. - RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds ``&quot;b64&quot;`` to the ``crit`` header parameter, and the decoder rejects tokens that set ``b64=false`` without listing it in ``crit``. Thanks to @MachineLearning-Nerd for the report. Changed </code></pre> <ul> <li>Migrate the <code>dev</code>, <code>docs</code>, and <code>tests</code> package extras to dependency groups by <a href="https://github.com/kurtmckee"><code>@kurtmckee</code></a> in <code>[#1152](https://github.com/jpadilla/pyjwt/issues/1152) &lt;https://github.com/jpadilla/pyjwt/pull/1152&gt;</code>__</li> </ul> <p><code>v2.12.1 &lt;https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1&gt;</code>__ </tr></table> </code></pre></p> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jpadilla/pyjwt/commit/7144e4534c34810f4525dc4578a32addd8212cff"><code>7144e45</code></a> Apply ruff format</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/d2f4bec4963897c0ef96ef64a875894f2c8542ab"><code>d2f4bec</code></a> Restore <code>cast()</code> calls with cross-version <code>type: ignore</code> for <code>prepare_key</code></li> <li><a href="https://github.com/jpadilla/pyjwt/commit/22f478cebddd8294259c30f037ecb92b0b348774"><code>22f478c</code></a> Remove redundant casts in <code>RSAAlgorithm.prepare_key</code> and `ECAlgorithm.prepare...</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81"><code>95791b1</code></a> Bundle security fixes and hardening into 2.13.0</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/dcc27a9d3182a2349c30b160758785c6ce7a6508"><code>dcc27a9</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1155">#1155</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/9d08a9a1896845ed8eaf88e6f6ac61e5800c3e7a"><code>9d08a9a</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1146">#1146</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/b87c10014d4109f0214fea188d00faaaf8a80e64"><code>b87c100</code></a> Bump codecov/codecov-action from 5 to 6 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1154">#1154</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/40e3147eb5f790d8d041772e5fc00728a176c812"><code>40e3147</code></a> Migrate development extras to dependency groups (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1152">#1152</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/a4e1a3d1218b01c5806420b8f16d9308ac4adc30"><code>a4e1a3d</code></a> Add typing_extensions dependency for Python < 3.11 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1151">#1151</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/bd9700cca7f9258fadcc429c1034e508025931f2"><code>bd9700c</code></a> Use PyJWK algorithm when encoding without explicit algorithm (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1148">#1148</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.11.0...2.13.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]andcopilot-swe-agent[bot]
|
614db62500 |
Python: Bump tornado from 6.5.5 to 6.5.7 in /python (#14090)
Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.7. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst">tornado's changelog</a>.</em></p> <blockquote> <h1>Release notes</h1> <p>.. toctree:: :maxdepth: 2</p> <p>releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2 releases/v3.2.1</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4"><code>48fc2d4</code></a> Merge pull request <a href="https://redirect.github.com/tornadoweb/tornado/issues/3633">#3633</a> from bdarnell/curl-reset-65</li> <li><a href="https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841"><code>4ae1ddd</code></a> Release notes and version bump for 6.5.7</li> <li><a href="https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43"><code>3154caa</code></a> curl_httpclient: Reset the curl object before putting it on the freelist</li> <li><a href="https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2"><code>7d869c0</code></a> Merge pull request <a href="https://redirect.github.com/tornadoweb/tornado/issues/3631">#3631</a> from bdarnell/cve-links</li> <li><a href="https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3"><code>288241f</code></a> docs: Use the correct link syntax</li> <li><a href="https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6"><code>8da981c</code></a> docs: Add CVE links to 6.5.6 release notes</li> <li><a href="https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751"><code>aba2569</code></a> Merge pull request <a href="https://redirect.github.com/tornadoweb/tornado/issues/3626">#3626</a> from bdarnell/fixes-656</li> <li><a href="https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09"><code>a24b260</code></a> httpclient_test: Accept an additional error message variant</li> <li><a href="https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24"><code>a74240a</code></a> Release notes and version bump for 6.5.6.</li> <li><a href="https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5"><code>e8fc7ed</code></a> simple_httpclient: Strip auth headers on cross-origin redirects</li> <li>Additional commits viewable in <a href="https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> |
||
|
dependabot[bot]
|
1ad0b7501b |
Bump Aspire.Hosting.AppHost from 13.0.0 to 13.3.0 (#13995)
Updated [Aspire.Hosting.AppHost](https://github.com/microsoft/aspire) from 13.0.0 to 13.3.0. <details> <summary>Release notes</summary> _Sourced from [Aspire.Hosting.AppHost's releases](https://github.com/microsoft/aspire/releases)._ ## 13.3.0 # Aspire 13.3.0 Aspire 13.3 is here! 🚀 This release is packed with new ways to deploy, debug, and build distributed apps — including `aspire destroy`, browser telemetry in the dashboard, Kubernetes deployment, first-class JavaScript publishing, and major TypeScript AppHost parity improvements. ## Highlights - 🧹 **Clean teardown** — New **`aspire destroy`** tears down Azure, Kubernetes, and Docker Compose deployments, and pipeline summaries make deploy/publish/destroy runs easier to follow. - 🔍 **Frontend telemetry** — **Aspire.Hosting.Browsers** captures browser console logs, network requests, and screenshots right in the Aspire dashboard. - ☸️ **Kubernetes deploy preview** — **`aspire deploy`** can now generate Helm-based Kubernetes deployments, with first-class Ingress and Gateway API routing. - 🟨 **JavaScript publishing** — New **`PublishAs*`** methods support static sites, Node servers, npm-script apps, Next.js, Vite, Bun, Yarn, and pnpm. - 🌐 **TypeScript AppHost parity** — Unified `withEnvironment`, Docker Compose hooks, endpoint expressions, Azure Container Apps domains, and more close the gap with C# AppHosts. - 🛠️ **CLI upgrades** — Run the standalone dashboard with **`aspire dashboard run`**, install the CLI as a NativeAOT `dotnet tool`, and search API docs from the terminal. - ☁️ **Azure goodness** — New Azure Front Door, Network Security Perimeter, AKS, private endpoint, and Foundry Prompt Agent support. - 🐳 **Better containers** — The Aspire container tunnel is now enabled by default for consistent host connectivity across Docker Desktop, Docker Engine, and Podman. ## ⚠️ Breaking changes Notable breaking changes include `--log-level` becoming `--pipeline-log-level`, the dashboard MCP server being replaced by `aspire agent init`, `dotnet new aspire-py-starter` moving to `aspire new aspire-py-starter`, and several API shape updates across AKS, Foundry, JavaScript diagnostics, and TypeScript AppHost helpers. See the full list in the [Aspire 13.3 breaking changes](https://aspire.dev/whats-new/aspire-13-3/#%EF%B8%8F-breaking-changes). ## 📖 Learn more For the full details, examples, migration guidance, and everything new in this release, check out [What's new in Aspire 13.3](https://aspire.dev/whats-new/aspire-13-3/). Thank you to all the community contributors who helped make Aspire 13.3 possible! 💜 ## 13.2.4 # Aspire 13.2.4 ## What's New in Aspire 13.2.4 Patch release addressing a security advisory in OpenTelemetry dependencies. ### 🐛 Fixes - 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#16420) ### 🏷️ Housekeeping - 🚀 Bumped branding to 13.2.4 (#16436) ## 13.2.3 # What's New in Aspire 13.2.3 Patch release focused on CLI packaging, signing, and reliability fixes. ## 🐛 Fixes - 🛑 aspire stop now properly cleans up application containers on Windows (#16123) - 🔐 Fixed macOS signing, permissions, and certificate trust with improved CI verification (#16053) - ✍️ Fixed signing for the aspire-managed bundle payload (#16211) - 🎭 Fixed Playwright CLI provenance verification for the new tag format (#16134) - 🧭 Updated service discovery environment variables (#16223) ## 🔧 Improvements - 📊 Removed telemetry API data limits and refactored URL builders (#16023) - ⏱️ Increased native build + sign timeout to 60 minutes for reliability (#16212) ## 🏷️ Housekeeping - 🔖 Bumped branding to 13.2.3 (#16181) - 🧪 Temporarily disabled Verify CLI archive step on Windows while investigating (#16276, #16285) ## 13.2.2 This is a servicing release focused on bug fixes and platform improvements. 🐛 Bug Fixes - Fix SqlClient runtime asset layout on Unix — Resolved an issue where Microsoft.Data.SqlClient failed to load correctly on macOS and Linux due to incorrect NuGet asset layout (#15709) - Fix IDE execution regressions for Azure Functions and class library projects — Backported fixes for 13.2 regressions impacting IDE-based execution (#15714) - Fix NpmRunner multi-version output parsing — npm view returning multiple versions no longer breaks version resolution; also bumps @playwright/cli to >=0.1.3 (#15746) - Skip name validation for internal resources — ProjectRebuilderResource, installer, and venv creator resources no longer fail the 64-char name limit since they're never deployed (#15726, fixes #15693) 🔒 Security & Certificates - Use ASP.NET Core dev cert for DCP — Avoids ephemeral certificate trust issues by using the standard ASP.NET Core developer certificate (#15718) - Cache PFX dev certs on Windows and Linux — Prevents binary-level changes between runs for persistent container scenarios (#15774) 🏗️ Infrastructure & Platform - ARM64 CLI support — Added win-arm64 and linux-arm64 to the native CLI archive build matrix (#15599) - Update DCP to 0.22.11 (#15713) 💻 CLI Improvements - Show anonymous dashboard URLs in aspire ps — The dashboard URL is now displayed even when running without authentication (#15731 ## 13.2.1 🐛 Bug Fixes - 🖥️ CLI bundles for ARM & musl — win-arm64, linux-arm64, and linux-musl-x64 bundles now correctly include DCP instead of silently producing broken installs (#15529) - ⚡ aspire new in VS Code — Fixed a race where the workspace switch severed the CLI terminal before the agent init prompt could complete (#15553) - 🔗 Dashboard resource URLs — The describe command no longer produces broken dashboard links with a stray /login?t=... in the path (#15495) - 🌍 Guest AppHost env vars — Launch profile environment variables are now correctly forwarded to guest AppHosts (#15637) - 📦 Legacy settings migration — .aspire/settings.json → aspire.config.json migration was silently skipped in some scenarios; now works reliably (#15526) - 🔧 TypeScript AppHost restore — Fixed config resolution during TS AppHost restore (#15625) - 🎭 Playwright CLI on Windows — aspire agent init now correctly installs playwright-cli on Windows (#15559) - 📌 Emulator stability — Pinned Kusto emulator image and improved Cosmos DB emulator reliability (#15504) ✨ Improvements - 🏗️ Brownfield TypeScript aspire init — Running aspire init in existing JS/TS projects now smartly merges package.json — scripts, dependencies, and engines — with semver-aware conflict handling (#15123) - 🎯 Endpoint filtering — New ExcludeReferenceEndpoint property lets you filter specific endpoints from WithReference (#15586) - 🌐 More polyglot ATS APIs — Exported additional hosting APIs for TypeScript and Go AppHost authoring (#15557) - 🔍 Short trace ID support — The dashboard now resolves short trace IDs in addition to full-length ones (#15613) - ⚠️ Aspire.Hosting.NodeJs deprecated — Use Aspire.Hosting.JavaScript instead; the old package no longer appears in aspire add (#15686) ## 13.2.0 # Aspire 13.2 Aspire 13.2 brings major CLI enhancements, a new TypeScript AppHost (preview), dashboard data export/import, Microsoft Foundry integration, and multi-language improvements — all focused on making local development more streamlined for developers and AI coding agents alike. ## Highlights - 🛠️ CLI overhaul — New commands including **aspire start/stop/ps** for detached mode, **aspire describe** for resource monitoring, **aspire doctor** for environment diagnostics, **aspire secret** for managing user secrets, **aspire docs** for browsing documentation from the terminal, and **aspire agent** (renamed from **aspire mcp**) for AI agent integration. - 🌐 TypeScript AppHost (preview) — Write your apphost in TypeScript with **createBuilder()**, using the same app model concepts as C#. Full VS Code extension support included. - 🧩 VS Code extension — Dedicated Aspire Activity Bar panel with live resource state, inline CodeLens with health status and actions, gutter decorations, and a new Getting Started walkthrough. - 📊 Dashboard improvements — Bulk telemetry export/import, export environment variables as **.env** files, a new telemetry HTTP API, set parameters directly from the dashboard, and improved resource graph layout. - 🤖 Microsoft Foundry — Replaces Azure AI Foundry integration with broader **Aspire.Hosting.Foundry** support including hosted agents and model deployments. - 🔒 Azure Virtual Network & Private Endpoints — New **Aspire.Hosting.Azure.Network** integration for defining VNets, subnets, NAT gateways, NSGs, and private endpoints directly in your apphost. - 🐳 Docker Compose publishing — Generate docker-compose.yaml from your app model with **AddDockerComposeEnvironment.** - 📦 New integrations — Azure Data Lake Storage, MongoDB EF Core (**Aspire.MongoDB.EntityFrameworkCore**), Bun support for JS resources, and Certbot for automated SSL certificates. - ⚡ App model — **WithMcpServer** for declaring MCP endpoints, **rebuild** command for project resources, contextual endpoint resolution, and improved secret/certificate handling. ## ⚠️ Breaking changes Notable breaking changes include service discovery env vars now using endpoint scheme instead of name, aspire.config.json replacing split config files, AIFoundry → Foundry rename, WithSecretBuildArg → WithBuildSecret, and updated default Azure credential behavior. [See the full list of breaking changes](https://aspire.dev/whats-new/aspire-13-2/#%EF%B8%8F-breaking-changes). ## 📖 Learn more For the full details on everything in this release, check out the [What's new in Aspire 13.2](https://aspire.dev/whats-new/aspire-13-2/) documentation. Thank you to all the community contributors who helped make this release happen! 💜 ## 13.1.3 ## What's Changed * [release/13.1] Add installer publishing updates for 13.1.3 by @radical in https://github.com/dotnet/aspire/pull/15158 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.2...v13.1.3 ## 13.1.2 ## What's Changed * Bump patch version from 13.1.1 to 13.1.2 by @Copilot in https://github.com/dotnet/aspire/pull/14699 * [release/13.1] Fix template version parsing for .NET 10.0 SDK separator change by @JamesNK in https://github.com/dotnet/aspire/pull/14698 * Update pipeline images to non-deprecated pools by @joperezr in https://github.com/dotnet/aspire/pull/14707 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.1...v13.1.2 ## 13.1.1 ## What's Changed * [release/13.1] Ensure WithHostHttpsPort works when chained inline by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13678 * [release/13.1] Escape backslashes in path string to discovered vite config by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13822 * [release/13.1] [Testing] Fixing bugs for sticky slot app settings by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13810 * [release/13.1] Fix AzureBicepResource file-not-found error when using templateFile with AzurePublishingContext by @github-actions[bot] in https://github.com/dotnet/aspire/pull/14018 * [release/13.1] Filter dev certs without X509SubjectKeyIdentifierExtension when any cert has it by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13676 * [release/13.1] Fix Aspire.ProjectTemplates build failure from command line length limits by @github-actions[bot] in https://github.com/dotnet/aspire/pull/14009 * [release/13.1] Update Azure.Identity package version to 1.17.1 by @eerhardt in https://github.com/dotnet/aspire/pull/14251 * Bump patch version from 13.1.0 to 13.1.1 by @Copilot in https://github.com/dotnet/aspire/pull/14329 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.1.0...v13.1.1 ## 13.1.0 We are excited to share that our 13.1.0 release of Aspire has shipped! All of the packages are available in NuGet.org now. Head over to https://aspire.dev/whats-new/aspire-13-1/ to find what's new in 13.1.0! ## What's Changed * Target net10.0 in client integrations by @eerhardt in https://github.com/dotnet/aspire/pull/12500 * Fix DockerComposeEnvironment duplicating image names in .env file by @Copilot in https://github.com/dotnet/aspire/pull/12310 * Replace apt-get with npm for Azure Functions Core Tools installation by @Copilot in https://github.com/dotnet/aspire/pull/12537 * Improve flaky dashboard integration test by @JamesNK in https://github.com/dotnet/aspire/pull/12534 * Add README.md for the Aspire.Hosting.Azure.AppService package by @ShilpiRach in https://github.com/dotnet/aspire/pull/12528 * Add support to enable automatic scaling for App Service Environment by @ShilpiRach in https://github.com/dotnet/aspire/pull/12305 * Update to FluentUI 4.13.1 by @JamesNK in https://github.com/dotnet/aspire/pull/12532 * Skip playground projects in build-packages workflow by @Copilot in https://github.com/dotnet/aspire/pull/12547 * Allow HostUrl to remap both address and port by @danegsta in https://github.com/dotnet/aspire/pull/12521 * Refactor NodeJs Integration by @eerhardt in https://github.com/dotnet/aspire/pull/12530 * Fix MCP endpoint with redirect HTTPS by @JamesNK in https://github.com/dotnet/aspire/pull/12556 * [main] Update dependencies from microsoft/usvc-apiserver by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12540 * Refactor AddNodeApp by @eerhardt in https://github.com/dotnet/aspire/pull/12538 * Update Aspire branding from 13.0 to 13.1 by @Copilot in https://github.com/dotnet/aspire/pull/12527 * Add annotation to specify custom base images for generated Dockerfiles by @Copilot in https://github.com/dotnet/aspire/pull/12566 * Fix generating random MCP endpoint URL in templates by @JamesNK in https://github.com/dotnet/aspire/pull/12558 * [CI] Add new Agent for disabling or quarantining tests by @radical in https://github.com/dotnet/aspire/pull/12570 * Add `ExcludeFromMcp()` resource extension by @JamesNK in https://github.com/dotnet/aspire/pull/12515 * Localized file check-in by OneLocBuild Task: Build definition ID 1309: Build ID 2828818 by @dotnet-bot in https://github.com/dotnet/aspire/pull/12546 * Register IPipelineOutputService in DI for pipeline output directory management by @Copilot in https://github.com/dotnet/aspire/pull/12563 * Add deploy support for Docker Compose by @captainsafia in https://github.com/dotnet/aspire/pull/12548 * Quarantine flaky test: AzureServiceBusEmulatorResourceGeneratesConfigJsonWithCustomizations by @Copilot in https://github.com/dotnet/aspire/pull/12578 * Update connection properties for non-Azure resources by @sebastienros in https://github.com/dotnet/aspire/pull/12583 * Filter to highest package version per channel in aspire add command by @Copilot in https://github.com/dotnet/aspire/pull/12553 * Log DCP messages at Debug/Trace level in AppHost by @Copilot in https://github.com/dotnet/aspire/pull/12533 * Add CLI self-update prompts to `aspire update` command by @Copilot in https://github.com/dotnet/aspire/pull/12395 * Fix golang and alpine images. by @mitchdenny in https://github.com/dotnet/aspire/pull/12592 * Replace ContainerTargetPlatform.AllLinux with LinuxAmd64 by @Copilot in https://github.com/dotnet/aspire/pull/12596 * [main] Update dependencies from microsoft/usvc-apiserver by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12610 * Make IReportingStep and IReportingTask completion idempotent by @Copilot in https://github.com/dotnet/aspire/pull/12602 * Show --log-level debug hint when pipeline fails by @Copilot in https://github.com/dotnet/aspire/pull/12603 * [main] Update dependencies from dotnet/arcade by @dotnet-maestro[bot] in https://github.com/dotnet/aspire/pull/12622 * Rename app.py to main.py in template by @eerhardt in https://github.com/dotnet/aspire/pull/12628 * bump extension version by @adamint in https://github.com/dotnet/aspire/pull/12623 * don't build apphost in cli when running in extension by @adamint in https://github.com/dotnet/aspire/pull/12621 * Detect which version of yarn is being used by @eerhardt in https://github.com/dotnet/aspire/pull/12633 * Fix duplicate key exception when using WithExplicitStart() on resources with environment callbacks by @Copilot in https://github.com/dotnet/aspire/pull/12604 * Support AddCSharpApp, fix some rough edges around project resources by @adamint in https://github.com/dotnet/aspire/pull/12568 * Add missing namespace to `CertificateAuthorityCollectionResource` by @danegsta in https://github.com/dotnet/aspire/pull/12639 * Add ModelContextProtocol assemblies to signing list by @joperezr in https://github.com/dotnet/aspire/pull/12637 * Generate fallback Dockerfile for Python apps without UV by @Copilot in https://github.com/dotnet/aspire/pull/12627 * Update/bump container image tags for hosting components by @joperezr in https://github.com/dotnet/aspire/pull/12459 * Mark IDeveloperCertificateService experimental by @danegsta in https://github.com/dotnet/aspire/pull/12648 * Wait with exponential backoff for expected Executables by @karolz-ms in https://github.com/dotnet/aspire/pull/12647 * Make ProcessCertificateTrustConfigAsync internal by @danegsta in https://github.com/dotnet/aspire/pull/12649 * Add test cases and ensure container cert override paths work by @danegsta in https://github.com/dotnet/aspire/pull/12654 * Python hosting: Support .venv lookup by walking up parent directories by @Copilot in https://github.com/dotnet/aspire/pull/12616 ... (truncated) ## 13.0.2 This patch is updating our Project Templates for our Python starter app to ensure we depend on the latest version of React. This is out of an abundance of caution, as we don't depend on any of the react packages that were flagged as vulnerable in https://github.com/advisories/GHSA-fv66-9v8q-g76r. ## What's Changed * Bump patch version from 13.0.1 to 13.0.2 by @Copilot in https://github.com/dotnet/aspire/pull/13324 * Update React and ReactDOM to version 19.2.1 across all projects by @joperezr in https://github.com/dotnet/aspire/pull/13325 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.0.1...v13.0.2 ## 13.0.1 ## What's Changed * Merge internal changes by @joperezr in https://github.com/dotnet/aspire/pull/12896 * [release/13.0] Fix Azure roles resources always redeploying by @github-actions[bot] in https://github.com/dotnet/aspire/pull/12903 * [release/13.0] Remove .py and .js files from being signed (#13005) by @eerhardt in https://github.com/dotnet/aspire/pull/13032 * [release/13.0] Fix subscription ID not being disabled on Azure provisioning dialog by @github-actions[bot] in https://github.com/dotnet/aspire/pull/12913 * [release/13.0] Default OpenAISettings.EnableSensitiveTelemetryData to TelemetryHelpers.EnableSensitiveDataDefault by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13017 * Bump patch version from 13.0.0 to 13.0.1 by @Copilot in https://github.com/dotnet/aspire/pull/13167 * [release/13.0] EndpointReference evaluation should wait on missing AllocatedEndpoint (#13074) by @karolz-ms in https://github.com/dotnet/aspire/pull/13076 * [release/13.0] Update to Npgsql 10 by @github-actions[bot] in https://github.com/dotnet/aspire/pull/13166 * [release/13.0] Update dependencies from microsoft/usvc-apiserver by @danegsta in https://github.com/dotnet/aspire/pull/13187 **Full Changelog**: https://github.com/dotnet/aspire/compare/v13.0.0...v13.0.1 Commits viewable in [compare view](https://github.com/microsoft/aspire/compare/v13.0.0...v13.3.0). </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
56422ada8a |
.Net: Bump follow-redirects from 1.15.11 to 1.16.0 in /dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend (#13877)
Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.11 to 1.16.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/0c23a223067201c368035e82954c11eb2578a33b"><code>0c23a22</code></a> Release version 1.16.0 of the npm package.</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/844c4d302ac963d29bdb5dc1754ec7df3d70d7f9"><code>844c4d3</code></a> Add sensitiveHeaders option.</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/5e8b8d024e2c76f804a284258e585ecb49a575be"><code>5e8b8d0</code></a> ci: add Node.js 24.x to the CI matrix</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/7953e2255aa0b93602eed3804f3bc5e6923a03af"><code>7953e22</code></a> ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/86dc1f86e4b56bcd642c78384d51f10f123aea75"><code>86dc1f8</code></a> Sanitizing input.</li> <li>See full diff in <a href="https://github.com/follow-redirects/follow-redirects/compare/v1.15.11...v1.16.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
a5e8f9b432 |
.Net: Bump form-data from 4.0.5 to 4.0.6 in /dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend (#14082)
Bumps [form-data](https://github.com/form-data/form-data) from 4.0.5 to 4.0.6. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/form-data/form-data/blob/master/CHANGELOG.md">form-data's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6">v4.0.6</a> - 2026-06-12</h2> <h3>Commits</h3> <ul> <li>[Fix] escape CR, LF, and <code>"</code> in field names and filenames <a href="https://github.com/form-data/form-data/commit/8dff42c6da654ed4e7ad4acb7f8ccd3831217c99"><code>8dff42c</code></a></li> <li>[Dev Deps] update <code>@ljharb/eslint-config</code>, <code>auto-changelog</code>, <code>tape</code> <a href="https://github.com/form-data/form-data/commit/f31d21ef10bf46e46344c3ee4f99acbef6be43e1"><code>f31d21e</code></a></li> <li>[Deps] update <code>hasown</code>, <code>mime-types</code> <a href="https://github.com/form-data/form-data/commit/92ae0eb5da94d6f01925d5f4fcffb2a1e50ed7cd"><code>92ae0eb</code></a></li> <li>[Dev Deps] update <code>js-randomness-predictor</code> <a href="https://github.com/form-data/form-data/commit/67b0f65c2e0b065a511d42227d35e4d367644e97"><code>67b0f65</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435"><code>64190db</code></a> v4.0.6</li> <li><a href="https://github.com/form-data/form-data/commit/92ae0eb5da94d6f01925d5f4fcffb2a1e50ed7cd"><code>92ae0eb</code></a> [Deps] update <code>hasown</code>, <code>mime-types</code></li> <li><a href="https://github.com/form-data/form-data/commit/f31d21ef10bf46e46344c3ee4f99acbef6be43e1"><code>f31d21e</code></a> [Dev Deps] update <code>@ljharb/eslint-config</code>, <code>auto-changelog</code>, <code>tape</code></li> <li><a href="https://github.com/form-data/form-data/commit/8dff42c6da654ed4e7ad4acb7f8ccd3831217c99"><code>8dff42c</code></a> [Fix] escape CR, LF, and <code>"</code> in field names and filenames</li> <li><a href="https://github.com/form-data/form-data/commit/67b0f65c2e0b065a511d42227d35e4d367644e97"><code>67b0f65</code></a> [Dev Deps] update <code>js-randomness-predictor</code></li> <li>See full diff in <a href="https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Evan Mattson
|
cd1b0205fa |
Python: Bump Python version to 1.43.1 for a release. (#14093)
### Motivation and Context Bump Python version to 1.43.1 for a release. <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Bump Python version to 1.43.1 for a release. <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [X] I didn't break anyone 😄python-1.43.1 |
||
|
Roger Barreto
|
6ba60965bd |
Python: Reject encoded dot-segment paths in OpenAPI plugin (.NET and Python) (#14086)
## Motivation and Context Closes #14085. The .NET and Python OpenAPI plugins select operations using the raw OpenAPI path, but build the runtime request URL from a canonicalized path. Encoded dot-segments such as `/resources/%2e%2e/admin` pass an `OperationSelectionPredicate` path check, yet `System.Uri` (.NET) and `urljoin` (Python) collapse them to a different route at request time. The selected path and the actual request target can therefore diverge. ## Description - **.NET** (`RestApiOperation.ValidatePathSegments`): decodes each path segment until stable (handling double encoding like `%252e` and encoded separators `%2f`/`%5c`) before rejecting canonical `.` or `..` segments. - **Python** (`RestApiOperation.build_path`): adds equivalent decode-then-reject validation before the URL is built. Regression tests on both stacks cover literal and encoded dot-segments, mixed case, encoded slashes, and double encoding, plus negative tests confirming legitimate encoded characters still work. Test results: - .NET: 482/482 `Functions.UnitTests` OpenApi tests pass. - Python: 109/109 `openapi_plugin` unit tests pass. ## Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the SK Contribution Guidelines - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 |