### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
Bumps the Python package version for the next release.
### Description
Updates `semantic_kernel.__version__` from `1.43.1` to `1.44.0`.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines and the
pre-submission formatting script raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I did not break anyone 😄
## Motivation and Context
The OpenAPI plugin imports operations from a spec and lets the host
restrict which operations are exposed via an
`OperationSelectionPredicate` (and via `OperationsToExclude`). Operation
selection and request-URL construction should share one canonical
interpretation of an operation path. This change closes two consistency
gaps where a spec-supplied path could be interpreted differently at
selection time than at request time.
1. **Selection vs. request path normalization.** The selection predicate
received the raw operation path, while the request URL is built from a
canonicalized path. An encoded dot-segment (for example `%2e%2e`) is
textually different from the endpoint it canonicalizes to, so it could
pass a path-based include/exclude filter yet resolve to a different
route. Operations whose path contains an encoded or literal dot-segment
are now excluded before the predicate is consulted, symmetric with the
existing request-time dot-segment rejection.
2. **Request target reconciliation (defense in depth).** After the
request URL is built, verify it did not move off the configured server.
An operation path that is an absolute or authority-changing URI (for
example `https://another-host/admin`) carries no dot-segment, so it
passes path-segment validation, yet `System.Uri` / `urljoin` resolve it
to a different scheme, host, or port. Such a request is now rejected
before it is sent, so a credential-bearing request cannot be redirected
to an unintended target.
Both changes are applied symmetrically to the .NET and Python OpenAPI
ports.
## Description
- **.NET**
- `OpenApiDocumentParser` skips operations whose path contains a
dot-segment before invoking the selection predicate.
- `RestApiOperation` extracts a shared `ContainsDotSegment` helper
(reused by the existing `ValidatePathSegments`) and, after building the
request URL, reconciles its scheme/host/port and base path against the
configured server.
- **Python**
- `openapi_parser` skips dot-segment operations before the predicate
runs.
- `rest_api_operation` adds a shared `_contains_dot_segment` helper and
a post-construction `_ensure_request_target_matches_server`
reconciliation.
## Tests
- .NET: added selection-exclusion and request-target reconciliation
tests; full `Functions.UnitTests` OpenApi suite green (488).
- Python: added parity tests for both behaviors;
`tests/unit/connectors/openapi_plugin` green (173), ruff + ruff-format +
mypy + pre-commit clean.
## Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines
- [x] All unit tests pass, and I have added new tests where possible
### Motivation and Context
The MCP server created by `create_mcp_server_from_kernel` (and the
`Kernel.as_mcp_server` wrapper) accepts an `excluded_functions` argument
to keep selected kernel functions off the server. Previously this list
was applied only when building the tool set advertised by the
`list_tools` handler; the `call_tool` handler did not consult it and
forwarded the client-supplied name straight to the kernel. As a result
the set of advertised tools and the set of callable tools could diverge.
### Description
- Derive a single `exposed_names` set from `functions_to_expose` and
check it in the `call_tool` handler, returning a `METHOD_NOT_FOUND`
error for any name that is not exposed.
- Remove a leftover `print` debug statement in `_call_kernel_function`.
- Add a unit test covering the `call_tool` behavior for a non-exposed
function.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines
- [x] All unit tests pass, and I have added new tests where possible
---------
Co-authored-by: Copilot <[email protected]>
## Summary
- Add server URL validation for Python OpenAPI operation execution
before outbound requests are made
- Add execution settings for trusted allowed base URLs and
private-network access
- Pass operation arguments into server variable resolution and add
regression coverage for substituted server hosts
## Testing
- `uv run pytest
tests/unit/connectors/openapi_plugin/test_server_url_validator.py
tests/unit/connectors/openapi_plugin/test_openapi_runner.py
tests/unit/connectors/openapi_plugin/test_openapi_manager.py
tests/unit/connectors/openapi_plugin/test_sk_openapi.py`
- `uv run pytest tests/integration/cross_language/test_cross_language.py
-k openapi`
- `uv run ruff check ...`
- `uv run ruff format --check ...`
---------
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Bump Python version to 1.43.1 for a release.
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump Python version to 1.43.1 for a release.
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [X] I didn't break anyone 😄
## Motivation and Context
Closes#14085.
The .NET and Python OpenAPI plugins select operations using the raw
OpenAPI path, but build the runtime request URL from a canonicalized
path. Encoded dot-segments such as `/resources/%2e%2e/admin` pass an
`OperationSelectionPredicate` path check, yet `System.Uri` (.NET) and
`urljoin` (Python) collapse them to a different route at request time.
The selected path and the actual request target can therefore diverge.
## Description
- **.NET** (`RestApiOperation.ValidatePathSegments`): decodes each path
segment until stable (handling double encoding like `%252e` and encoded
separators `%2f`/`%5c`) before rejecting canonical `.` or `..` segments.
- **Python** (`RestApiOperation.build_path`): adds equivalent
decode-then-reject validation before the URL is built.
Regression tests on both stacks cover literal and encoded dot-segments,
mixed case, encoded slashes, and double encoding, plus negative tests
confirming legitimate encoded characters still work.
Test results:
- .NET: 482/482 `Functions.UnitTests` OpenApi tests pass.
- Python: 109/109 `openapi_plugin` unit tests pass.
## Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
### Description
Adds `function_choice_behavior` parameter to Azure AI and OpenAI
Assistant agents, aligning them with the existing Responses agent and
Chat Completion agent APIs.
### Changes
- Add `function_choice_behavior` parameter to
`invoke`/`invoke_stream`/`get_response` on both `AzureAIAgent` and
`OpenAIAssistantAgent` public APIs
- Add `function_choice_behavior` parameter to internal
`AzureAIAgentThreadActions` and `AssistantThreadActions`
`invoke`/`invoke_stream` methods
- Support `tools` parameter override for SDK-level tools
(CodeInterpreter, FileSearch, etc.)
- Filter kernel functions based on `FunctionChoiceBehavior`
configuration
- Validate that only `Auto` type with auto-invoke enabled is supported
- Fix `_get_tools` in OpenAI path to use passed `kernel` parameter
instead of `agent.kernel`
- Add comprehensive unit tests for both thread actions and public agent
APIs
---------
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Bump Python package version to 1.43.0 for a release
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump Python package version to 1.43.0 for a release
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
Update OpenAPI document parsing to gate file and HTTP ref resolution
separately.
### Breaking change
- `RESOLVE_FILES` is no longer enabled by default. Only internal JSON
pointer references are resolved by default.
- Users with multi-file OpenAPI specs must now pass
`enable_file_ref_resolution=True` via
`OpenAPIFunctionExecutionParameters`.
- `enable_external_ref_resolution` has been renamed to
`enable_http_ref_resolution`.
---------
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Bump Python pkg version to 1.42.0 for a release.
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump Python pkg version to 1.42.0 for a release.
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [X] I didn't break anyone 😄
### Motivation and Context
Improvements for MCP tool calls by adding an optional sampling callback.
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Improvements for MCP tool calls by adding an optional sampling callback.
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
---------
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
CI fails with `AttributeError: 'SearchIndexClient' object has no
attribute '_endpoint'` when `azure-search-documents` resolves to 12.0.0
(released 2026-04-01). The 12.0.0 release migrated from AutoRest to
TypeSpec code generation, removing private attributes `_endpoint` and
`_credential` from `SearchIndexClient`.
CI uses `uv sync -U` which upgrades past the lockfile, pulling in 12.0.0
since `pyproject.toml` specifies `>= 11.6.0b4` with no upper bound.
### Description
Stop reading `SearchIndexClient._endpoint` and `._credential`. Instead,
store endpoint and credential as explicit fields on `AzureAISearchStore`
and `AzureAISearchCollection`, and pass them directly when constructing
`SearchClient`.
**Changes:**
- `_get_search_client()` accepts explicit `endpoint` + `credential`
params instead of extracting from `SearchIndexClient` private attrs
- `_resolve_credential()` new helper extracted from
`_get_search_index_client()` for reuse
- `AzureAISearchStore` / `AzureAISearchCollection` store
`search_endpoint` and `search_credential` as fields, thread them through
construction
- Tests updated to assert on public fields instead of private SDK
attributes
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] All unit tests pass with both `azure-search-documents==11.7.0b2`
and `==12.0.0`
- [x] No breaking changes to public API
---------
Co-authored-by: Copilot <[email protected]>
Apply `urllib.parse.quote(safe='')` to path parameter values before
substitution in `build_path()`, consistent with the .NET implementation
which uses `HttpUtility.UrlEncode`.
### Changes
- `rest_api_operation.py`: encode path parameter values per RFC 3986
- `test_sk_openapi.py`: add tests for encoded path parameters
- `pyproject.toml` / `uv.lock`: pin `azure-search-documents >= 11.6.0b4,
< 12.0.0`
### Pin azure-search-documents < 12.0.0
Version 12.0.0 removed the internal `_endpoint` attribute from
`SearchIndexClient`, which breaks `AzureAISearchCollection`
initialization at `azure_ai_search.py:158`. Pinning to `< 12.0.0` until
the code is updated to use the new public API.
### Tests
All existing and new `build_path` tests pass.
---------
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Bump package version to 1.41.3 for a release
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump package version to 1.41.3 for a release
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
## Summary
- Minor defense-in-depth hardening for `InMemoryCollection` filter
parsing.
- Extends the internal dunder attribute blocklist and adds a regression
test covering the blocked set.
## Test plan
- [x] `uv run pytest tests/unit/connectors/memory/test_in_memory.py`
### Motivation and Context
bump py version to 1.41.2 for a release
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
bump py version to 1.41.2 for a release
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [X] I didn't break anyone 😄
### Motivation and Context
This PR updates the Jinja2 and Handlebars prompt-template helpers to
serialize chat messages through the existing XML/message serializer
instead of assembling message XML manually. It also aligns the
prompt-template samples with the serializer-backed helper and adds
regression coverage for common message content.
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Prompt template message serialize improvements.
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
---------
Co-authored-by: MAF Dashboard Bot <[email protected]>
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Bump Pythong version to 1.41.1 for a release
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump Pythong version to 1.41.1 for a release
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [X] I didn't break anyone 😄
### Motivation and Context
Closes#12442
When `ChatCompletionAgent` instances are used as plugins with
`GoogleAIChatCompletion`, the application crashes with:
```
ValueError: Unknown field for Schema: anyOf
```
**Root cause**: The Semantic Kernel JSON schema builder generates
`anyOf` for Union types (e.g. `str | list[str]` on the agent's
`messages` parameter) and type-as-array for Optional types (e.g.
`["string", "null"]`). Google AI's protobuf `Schema` does not support
these constructs.
### Description
Add `sanitize_schema_for_google_ai()` to `shared_utils.py` that
recursively rewrites unsupported schema constructs:
- `anyOf` / `oneOf` with a null variant → single type + `nullable: true`
- `anyOf` / `oneOf` without null → picks the first variant
- `type` as array (e.g. `["string", "null"]`) → single type + `nullable:
true`
Applied in both
`kernel_function_metadata_to_google_ai_function_call_format()` and
`kernel_function_metadata_to_vertex_ai_function_call_format()`.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] The existing tests pass, and I have added 12 new regression tests
- [x] I didn't break any existing functionality
> [!NOTE]
> AI-assisted contribution: Claude helped with code review, test
generation, and formatting.
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Evan Mattson <[email protected]>
## Summary
Fixes#13483
### Motivation and Context
When `use_vertexai=True`, users authenticate via Application Default
Credentials (ADC) and don't need an API key. However, the initialization
check for `api_key` runs unconditionally, blocking Vertex AI users with:
```
ServiceInitializationError: The API key is required when use_vertexai is False.
```
### Description
Guard the `api_key` validation with `not
google_ai_settings.use_vertexai` in all three Google AI service classes:
- `GoogleAIChatCompletion`
- `GoogleAITextCompletion`
- `GoogleAITextEmbedding`
The error message already reads *"when use_vertexai is False"*, so the
condition now matches the intent.
### Before / After
```python
# Before — fails even with use_vertexai=True
GoogleAIChatCompletion(
use_vertexai=True,
cloud_project_id="my-project",
cloud_region="us-central1"
)
# → ServiceInitializationError: The API key is required when use_vertexai is False.
# After — works correctly
GoogleAIChatCompletion(
use_vertexai=True,
cloud_project_id="my-project",
cloud_region="us-central1"
)
# → Initializes successfully, uses ADC for authentication
```
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] The code follows the [SK coding
standards](https://github.com/microsoft/semantic-kernel/blob/main/python/README.md)
---------
Co-authored-by: giulio-leone <[email protected]>
Co-authored-by: giulio-leone <[email protected]>
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Follow-up to #13499. The previous PR added the `allowed_module_prefixes`
parameter but defaulted it to `None`, which meant the module restriction
was only active if developers discovered and configured it.
Secure-by-default is the right posture here — restrict first, let
developers widen as needed.
- Change `allowed_module_prefixes` default from `None` to
`("semantic_kernel.",)` across Dapr runtime step loading
- Non-SK step classes now require developers to explicitly add their
module prefix (e.g. `("semantic_kernel.", "myapp.steps.")`)
- Developers can pass `None` to opt out entirely, but the secure default
is now enforced
- The Dapr runtime code is experimental, so this is a non-breaking
change per our stability guarantees
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
---------
Co-authored-by: MAF Dashboard Bot <[email protected]>
Co-authored-by: Copilot <[email protected]>
## Summary
Fixes#12708
`ChatHistoryTruncationReducer.reduce()` can orphan `TOOL` role messages
by truncating the preceding `assistant` message that contains the
`tool_calls`, causing OpenAI to reject the history with:
```
messages with role 'tool' must be a response to a preceding message with 'tool_calls'
```
## Root Cause
`locate_safe_reduction_index()` uses
`contains_function_call_or_result()` to detect tool-related messages
during its backward scan. This function only checks `msg.items` for
`FunctionCallContent`/`FunctionResultContent` instances.
However, `TOOL` role messages can contain only text content (no
`FunctionResultContent` in `items`), which causes the backward scan to
treat them as regular messages. The truncation point then lands between
the `tool_calls` assistant message and its `TOOL` responses, orphaning
the tool results.
## Fix
Added `AuthorRole.TOOL` check to `contains_function_call_or_result()`:
```python
if msg.role == AuthorRole.TOOL:
return True
```
This ensures **any** `TOOL` role message is recognized as part of a tool
call/result pair, regardless of whether it has `FunctionResultContent`
in its `items`.
## Test
Added
`test_locate_safe_reduction_index_tool_role_without_function_result_content`
that verifies TOOL role messages with only text content are not
separated from their tool call.
---------
Co-authored-by: giulio-leone <[email protected]>
Co-authored-by: Evan Mattson <[email protected]>
Co-authored-by: Copilot <[email protected]>
## Summary
`ChatHistoryTruncationReducer.reduce()` silently deletes
system/developer messages when truncating chat history. This is because
it calls `extract_range()`, which unconditionally filters out
system/developer messages — a function designed for the summarization
use case, not truncation.
Fixes#12612.
## Approach
Port the .NET SDK fix (PR #10344) to Python:
1. Detect the first system/developer message before truncation
2. Pass `has_system_message=True` to `locate_safe_reduction_index` so
`target_count` accounts for the preserved message (matches .NET's
`targetCount -= hasSystemMessage ? 1 : 0`)
3. Use a simple `history[truncation_index:]` slice instead of
`extract_range` (which strips system messages)
4. Prepend the system message if it was truncated away
Also adds a guard for `target_count <= 0` after the system message
adjustment to prevent `IndexError` when `target_count=1`.
## Changes
| File | Change |
|------|--------|
| `chat_history_reducer_utils.py` | Add `has_system_message` parameter,
adjust `target_count`, guard against `<= 0` |
| `chat_history_truncation_reducer.py` | Detect system message, bypass
`extract_range`, prepend if truncated |
| `test_chat_history_truncation_reducer.py` | Update 2 existing tests +
4 new tests (system, developer, no-system, target_count=1) |
## Note
The summarization reducer (`ChatHistorySummarizationReducer`) has the
same bug — it also uses `extract_range` and loses system messages during
summarization. The .NET summarization reducer preserves system messages
via `AssemblySummarizedHistory`. This should be addressed in a follow-up
PR to keep this change focused.
## Test plan
- [x] 11/11 truncation reducer tests pass (was 7, now 11)
- [x] 9/9 utils tests pass (no regressions from new parameter)
- [x] 11/11 summarization reducer tests pass (unaffected)
- [x] Reproduces and fixes the exact scenario from #12612
- [x] Edge case: `target_count=1` with system message does not crash
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Evan Mattson <[email protected]>
### Motivation and Context
Fixes#13632
When a prompt contains HTML tags such as `<p>`, `<div>`, `<b>`, etc.,
the
`ChatHistory.from_rendered_prompt()` method wraps the rendered prompt in
a
`<root>` element and parses it as XML. Any child elements whose tag
names do
not match the known SK template tags (`message`, `chat_history`) were
silently
skipped, causing their text content to be lost. This meant a prompt
like:
```
Translate: "<p>What is your name?</p>"
```
would arrive at the LLM as an empty message, because `<p>What is your
name?</p>`
was discarded during XML traversal.
### Description
In `ChatHistory.from_rendered_prompt`, when an XML child element has an
unrecognized tag (i.e. it is not `message` or `chat_history`), the
element
is now serialized back to its original text representation and appended
to
the preceding message content. The element's tail text is likewise kept
in
the same message, preserving the full original prompt text.
**Changed files:**
- `python/semantic_kernel/contents/chat_history.py` -- handle unknown
XML
tags as literal text in `from_rendered_prompt()`
- `python/tests/unit/contents/test_chat_history.py` -- added four
regression
tests covering HTML `<p>`, multiple HTML tags, HTML surrounded by text,
and SK tags mixed with HTML
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] The existing tests pass and new tests have been added
- [x] I didn't break any existing functionality
---------
Co-authored-by: Evan Mattson <[email protected]>
### Motivation and Context
Fixes#13480
When using Gemini models (2.5 Pro / 3 Pro) with thinking enabled, the
API returns a `thought_signature` on function call `Part` objects. Per
[Google's Thought Signatures
documentation](https://ai.google.dev/gemini-api/docs/thought-signatures),
this signature **must** be included in subsequent requests. Without it,
follow-up turns with tool results fail with:
```
HTTP 400: Function call is missing a thought_signature in functionCall parts
```
The .NET connector was already fixed in #13418. This PR applies the
equivalent fix to the Python connector.
### Description
**Response parsing** (capture `thought_signature`):
- `google_ai_chat_completion.py`: When creating `FunctionCallContent`
from response parts, capture `part.thought_signature` into
`FunctionCallContent.metadata` (both non-streaming and streaming paths)
- `vertex_ai_chat_completion.py`: Same capture via
`part_dict.get("thought_signature")` for Vertex AI
**Request building** (restore `thought_signature`):
- `google_ai/services/utils.py`: In `format_assistant_message()`, when a
`FunctionCallContent` has `thought_signature` in its metadata, construct
the `Part` directly with the `thought_signature` parameter instead of
using `Part.from_function_call()`
- `vertex_ai/services/utils.py`: In `format_assistant_message()`,
include `thought_signature` in the `Part.from_dict()` dictionary when
present
**Backward compatible**: When `thought_signature` is not present
(thinking disabled or older models), behavior is identical to before.
### Test Coverage
Added 4 new tests:
- `test_format_assistant_message_with_thought_signature` (Google AI) —
verifies round-trip preservation
- `test_format_assistant_message_without_thought_signature` (Google AI)
— verifies backward compatibility
- `test_format_assistant_message_with_thought_signature` (Vertex AI) —
verifies round-trip preservation
- `test_format_assistant_message_without_thought_signature` (Vertex AI)
— verifies backward compatibility
All 110 existing Google connector tests continue to pass.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] All unit tests pass, and I have added new tests
- [x] I didn't break anyone 😄
---------
Co-authored-by: giulio-leone <[email protected]>
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Bump Python version to 1.41.0 for a release
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump Python version to 1.41.0 for a release
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
Dall-e-3 and Dall-e-2 have been deprecated. The newer gpt-1-image model
returns base64 strings.
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
Return url if set, otherwise return the base64 string.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
---------
Co-authored-by: Evan Mattson <[email protected]>
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
Fixes another way of escaping allowed commands.
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
Improves the robustness of filename handling in the Bedrock agent
integration. Ensures that filenames sourced from external responses are
properly sanitized before use in file operations, and adds safer
defaults for file write behavior.
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
1. Sanitize filenames received from Bedrock agent responses.
2. Add overwrite parameter to BinaryContent.write_to_file (defaults to
False).
3. Add tests.
4. Update samples.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
Bump py version to 1.40.0 for a release
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump py version to 1.40.0 for a release
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
As of 2/27/2026, revived the PR, and the latest code is working for both
Azure OpenAI realtime models and OpenAI realtime models.
SK has support for realtime-preview models; however, since they've gone
to GA we have not added support for the latest library abstractions.
This PR brings in the changes to support running models like
`gpt-realtime-1.5`, `gpt-realtime`, `gpt-realtime-mini` or `gpt-audio`.
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
- Closes#13267
- Code now relies on `openai` >= 2.0
- Considered a breaking change due some new config added to the
execution settings.
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
Bumps version
Fixes new MCP version package, and upgrades some other packages.
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
further refinement of in memory filtering
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
### Motivation and Context
Bump Python version to 1.39.3 for a release
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump Python version to 1.39.3 for a release
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
The Dapr Runtime uses string-based class names to load step classes
dynamically. This PR adds validation to ensure that only valid
KernelProcessStep subclasses can be loaded and instantiated, improving
type safety and providing better error messages when misconfigured.
The new allowed_module_prefixes parameter gives users control over which
modules are permitted for step class loading, which can be useful in
environments where stricter control is desired.
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
- Add issubclass(cls, KernelProcessStep) validation when loading step
classes from qualified names
- Add optional allowed_module_prefixes parameter for restricting which
modules can be loaded
- Centralize class loading logic in get_step_class_from_qualified_name()
utility function
- Remove duplicate _get_class_from_string methods from DaprStepInfo and
StepActor
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
Overriding merge checks as there are unrelated Python integration test failures
### Motivation and Context
- Uploads: Require both EnableDangerousFileUploads = true AND
AllowedUploadDirectories configured
- Downloads: Permissive by default, but if AllowedDownloadDirectories is
configured, path validation
applies
- Both use path canonicalization to prevent traversal attacks
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
### Motivation and Context
When `SessionsPythonTool` is used with an AI model, providing explicit
directory boundaries for file operations gives developers fine-grained
control over which parts of the filesystem the plugin can access. This
follows the pattern established by `HttpPlugin.allowed_domains`.
- Add `allowed_upload_directories` parameter to control which local
directories can be used for file uploads
- Add `allowed_download_directories` parameter for optional restrictions
on file download destinations
- Implement path canonicalization to resolve symlinks and normalize
paths
Usage:
```python
tool = SessionsPythonTool(
credential=credential,
allowed_upload_directories={"/app/data/uploads", "/app/user_files"},
allowed_download_directories={"/app/data/downloads"}, # optional
)
```
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
- `upload_file` now requires `allowed_upload_directories` to be
configured (deny-by-default)
- `download_file` optionally supports `allowed_download_directories`
(permissive-by-default, since it's not exposed as a kernel function)
- Both parameters accept `set[str]` or `list[str]` for convenience
- Paths are canonicalized using `os.path.realpath()` before validation
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
Adds allowed_domains setup for HttpPlugin.
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
### Motivation and Context
Bump Python version to 1.39.2 for a release
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump Python version to 1.39.2 for a release
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
Fixes some issues with the forbidden list approach for the in-memory
vector store filtering.
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
Bump to v1.39.1 for a release
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump to v1.39.1 for a release
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
SergeyMenshykh