## Summary
- bump SK .NET packages from 1.80.0 to 1.80.1
- update the package validation baseline from 1.79.0 to 1.80.0
## Rationale
Changes since dotnet-1.80.0 are maintenance updates without new public
APIs or features, so this is a patch release.
Co-authored-by: Copilot App <[email protected]>
Copilot-Session: be9e3ab4-e9ee-4871-8b21-a62c2b732f74
## Summary
- update Transformers and related Hugging Face packages
- refresh Python dependencies used by the MCP OAuth demo
- regenerate the affected uv lockfiles
- adapt the Hugging Face text completion connector to Transformers 5
- temporarily disable live tests that depend on the retired Assistants
API
## Hugging Face connector
Transformers 5 removes the `text2text-generation`, `summarization` and
`translation` pipeline tasks, so `HuggingFaceTextCompletion` raised
`KeyError: Unknown task text2text-generation` on construction.
Those two tasks now use a small adapter built on `AutoModelForSeq2SeqLM`
and `AutoTokenizer` that preserves what the removed pipelines did:
- the same output keys (`summary_text` for summarization,
`generated_text` otherwise), so the content mapping is unchanged
- the model's task specific prefix (e.g. `summarize: `) is still
prepended before tokenization
- one record per generated sequence when `num_return_sequences > 1`
- `model_kwargs` are shared with the tokenizer load, as `pipeline()` did
- pipeline only options are dropped with a warning instead of reaching
`generate()`
`text-generation` keeps using `pipeline()`. There is no public API
change.
The previous unit tests mocked `pipeline()` and so did not catch the
incompatibility. New tests cover the adapter, option routing, device
placement, output mapping and prefix resolution.
## Temporarily disabled tests
The OpenAI and Azure OpenAI Assistants API has been retired. Live
requests now return HTTP 410 (`assistants_api_deprecated`) on Azure
OpenAI and HTTP 404 on OpenAI, so these tests cannot exercise a
functioning service.
- all 30 parametrized cases in
`tests/integration/agents/openai_assistant_agent/test_openai_assistant_agent_integration.py`
are skipped at module level, before the live-service fixture runs
- the `step1_openai_assistant` case in `tests/samples/test_concepts.py`
is skipped unconditionally
- the other concept samples are unchanged
- all 103 tests under `tests/unit/agents/openai_assistant` remain
enabled and passing
The skips are intentionally limited to live tests for the retired API.
Comments next to each skip include the migration guide and state that
the skip should be removed after the agents and sample move to the
replacement API.
## Validation
- uv lock consistency checks
- 35 Hugging Face unit tests pass
- all 12 deliberate connector mutations used to assess regression
coverage were detected by the unit tests
- all 103 Assistants agent unit tests pass
- 30 live Assistants integration cases and the one retired-API concept
sample report as skipped before making service requests
- the three text completion services used by the integration suite were
exercised against their real models on Transformers 5, for both
completion and streaming
- Ruff check and formatting pass
---------
Co-authored-by: Evan Mattson <[email protected]>
Co-authored-by: Copilot App <[email protected]>
Copilot-Session: c2d4dd29-0a9c-4f43-b2ce-243e19ec34b2
### Motivation and Context
The OpenAI Assistants API has been retired. The .NET integration
pipeline now receives `HTTP 410 (assistants_api_deprecated)` from Azure
OpenAI, causing 43 agent integration test failures.
Failing job:
https://github.com/microsoft/semantic-kernel/actions/runs/33497308634/job/99822416385
### Description
- Remove the retired OpenAI Assistant agent integration tests and their
shared fixture.
- Remove mixed-agent integration tests that depend on the Assistants
API.
- Keep Chat Completion and Aggregator agent tests using their own
classes as user-secrets assembly markers.
The production Assistants implementation is intentionally unchanged and
can be removed separately.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 6c360f47-9139-42f1-9dca-4b8ab68f7a53
### Motivation and Context
Keep the MCP OAuth demo aligned with the current Semantic Kernel Python
SDK release and public API signatures.
### Description
- Update the sample's Semantic Kernel dependency to 1.44.1.
- Refresh the lockfile for the updated dependency graph.
- Align timeout and agent-thread type annotations with the current SDK
APIs.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All applicable checks pass; no new unit tests are needed for this
sample dependency update
- [x] I didn't break anyone 😄
---------
Copilot-Session: 71b0555a-bf39-4b88-8ff9-9a1178453c1b
~CFS users will get dependencies restoration issues in dotnet unless
they remove the nuget.config locally. This pull request documents that
so they get unstuck~
after further discussions, this only carries the default configuration
any dotnet user should have. And it's problematic for CFS users. So
we'll simply remove the nuget.config file.
Co-authored-by: SergeyMenshykh <[email protected]>
This updates all the OpenAPI related dependencies since
Microsoft.OpenAPI has released numerous patches.
---------
Signed-off-by: Vincent Biret <[email protected]>
Co-authored-by: SergeyMenshykh <[email protected]>
## Summary
This PR pins GitHub Actions to full-length commit SHAs for improved
security and reproducibility and adds a 7 day cooldown to Dependabot
configuration for GitHub Actions. This work is described in more detail
at https://aka.ms/action-pinning.
## Why?
Pinning actions to commit SHAs prevents supply-chain attacks where a tag
could be moved to point to malicious code. This is a recommended
security best practice per the [GitHub Actions security hardening
guide](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions).
This change mitigates the risk of tag retargeting to malicious code as
seen in incidents like the [tj-actions/changed-files action
compromise](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised)
or [codfish/semantic-release-action
compromise](https://www.stepsecurity.io/blog/supply-chain-compromise-codfish-semantic-release-action)
and improves the integrity and reproducibility of the CI/CD pipeline.
## What changed?
**Action pinning:** Third-party action references in
`.github/workflows/` that used mutable tag-based references (e.g.,
`actions/checkout@v4`) have been updated to full-length commit SHAs with
a version comment (e.g., `actions/checkout@<sha> # v4`) using the
[pinact](https://github.com/suzuki-shunsuke/pinact) tool. References
that were already pinned to a SHA, or that used immutable release tags,
were left unchanged.
**Dependabot configuration:** `.github/dependabot.yml` has been updated
to ensure a `github-actions` package-ecosystem section is present with a
`cooldown` configuration (`default-days: 7`). If the file did not exist,
it was created. If a `github-actions` section already existed, only the
`cooldown` block was added or its `default-days` value was increased to
7 if it was lower. The 7-day cooldown provides a window for the
community to detect and report compromised releases before they are
automatically proposed as updates, reducing exposure to supply-chain
attacks via newly published malicious versions.
## Is this safe to merge?
Yes. The pinned SHAs correspond to the same commits that the existing
tags pointed to. No behavioral changes in action execution are
introduced. You can verify the pinned SHA value using the GitHub REST
API (e.g., the commit hash for `actions/checkout@v7` can be found in the
`sha` property in the JSON response for `GET
https://api.github.com/repos/actions/checkout/commits/v7`).
## Additional Information
For more information, please see https://aka.ms/action-pinning
Co-authored-by: westey <[email protected]>
### Motivation and Context
The model used by this test is deprecated and the test is blocking
merges.
### Description
Switch to replacement model
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
The Copilot Studio agent exposed a `SERVICE` authentication mode that
was never reachable — it was guarded to always raise before its
implementation ran. Its dormant credential handling also triggered
certificate-related static analysis alerts.
### Description
Removes the service authentication path along with its settings,
parameters, tests, and documentation. `CopilotStudioAgentAuthMode` is
kept with its `INTERACTIVE` member, which is the only supported mode.
Interactive authentication is unchanged.
Service authentication can be reintroduced later as a complete, tested
feature.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
---------
Copilot-Session: 25dd6e2a-f759-4148-a630-40110e90eff2
### Motivation and Context
Resolves the SSH.NET high-severity vulnerability reported by NuGet
auditing.
### Description
Updates Testcontainers.Milvus and Testcontainers.MongoDB to 4.14.0,
which uses the patched SSH.NET 2026.0.0 dependency.
### Contribution Checklist
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
Copilot-Session: 26c910de-c080-4e3e-909f-3d84769b6654
## Motivation and Context
The Gemini connector converts a `FunctionChoiceBehavior` (FCB) into the
connector-internal `GeminiToolCallBehavior` in
`GeminiPromptExecutionSettings`. That conversion only inspected the
`AutoInvoke` flag and evaluated the behavior against an empty kernel, so
the configured function list and choice were dropped:
- `FunctionChoiceBehavior.Auto()` / `Auto([subset])` always provided
**all** kernel functions to the model, regardless of the list supplied.
- `FunctionChoiceBehavior.Auto([])`, which is documented as equivalent
to disabling function calling, still provided all kernel functions.
- Explicit function lists failed to convert because the behavior was
evaluated against an empty kernel.
This diverges from the other connectors, which resolve the behavior
against the request kernel and provide exactly the functions it
specifies.
## Description
- Resolve the `FunctionChoiceBehavior` against the request's kernel and
provide exactly the functions it declares (all, an explicit subset, or
none), matching the shared function-calling semantics used by the other
connectors.
- An empty function list now correctly disables function calling.
- Perform the conversion on a clone so shared or frozen settings
instances are not mutated and the resolved result is not cached across
different kernels.
- Add a kernel-aware `FromExecutionSettings(settings, kernel)` overload
and use it from `GeminiChatCompletionClient`.
## Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
---------
Co-authored-by: Copilot <[email protected]>
Copilot-Session: c0e4edcd-4d36-486f-950b-9c0c36fa68e8
Updated
[CommunityToolkit.VectorData.InMemory](https://github.com/CommunityToolkit/AI)
from 1.0.0 to 1.0.1.
<details>
<summary>Release notes</summary>
_Sourced from [CommunityToolkit.VectorData.InMemory's
releases](https://github.com/CommunityToolkit/AI/releases)._
No release notes found for this version range.
Commits viewable in [compare
view](https://github.com/CommunityToolkit/AI/commits).
</details>
Updated [System.Numerics.Tensors](https://github.com/dotnet/dotnet) from
10.0.9 to 10.0.10.
<details>
<summary>Release notes</summary>
_Sourced from [System.Numerics.Tensors's
releases](https://github.com/dotnet/dotnet/releases)._
No release notes found for this version range.
Commits viewable in [compare
view](https://github.com/dotnet/dotnet/commits).
</details>
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
### Motivation and Context
All .NET MEVD vector store providers have been migrated to the
[CommunityToolkit/AI
repository](https://github.com/CommunityToolkit/AI). This removes the
now-redundant source code and tests from this repo and leaves
discoverable redirects in their place.
### Description
**Removed source + tests** for 12 providers (Chroma and Milvus kept
unchanged):
- **AzureAISearch, CosmosMongoDB, CosmosNoSql, InMemory, PgVector,
Qdrant, Redis, SqlServer, SqliteVec, Weaviate** → moved to
[CommunityToolkit/AI/MEVD/src/](https://github.com/CommunityToolkit/AI/tree/main/MEVD/src)
- **MongoDB** → moved to
[mongodb/mongo-mevd-provider](https://github.com/mongodb/mongo-mevd-provider)
- **Pinecone** → removed; Pinecone archived their [.NET
SDK](https://github.com/pinecone-io/pinecone-dotnet-client), no longer
supported
- **Common** → removed (was only shared by SqlServer/SqliteVec/PgVector,
all gone)
**Added `README.md`** in each removed provider directory pointing to the
new upstream location (or explaining Pinecone deprecation).
**Removed all associated test projects** including the shared
`VectorData.ConformanceTests` infrastructure (no remaining consumers
after provider removal).
**Updated `dotnet/MEVD.slnx`** — now contains only Chroma and Milvus.
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
---------
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
### Motivation and Context
Bump Python version to 1.44.1 for a release
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
Bump Python version to 1.44.1 for a release
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [X] I didn't break anyone 😄
### Motivation and Context
Prepares the .NET packages for the next minor release.
### Description
- Bumps `VersionPrefix` from `1.78.0` to `1.79.0`.
- Advances `PackageValidationBaselineVersion` from `1.77.0` to `1.78.0`.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
Copilot-Session: 2a1e876a-251c-403d-bc89-8e02610a19ae
### Motivation and Context
`_CopilotStudioAgentTokenFactory._cert_thumbprint` computes the X.509
certificate thumbprint that is passed to MSAL as the `thumbprint` client
credential. This value is the JWT `x5t` header, which MSAL and Microsoft
Entra ID require to be a SHA-1 digest - any other digest would be
rejected by the token endpoint.
Because it is a plain digest call, static analysis tooling flags it even
though the hash is used purely as a certificate identifier, not as a
cryptographic/security primitive (the call already passes
`usedforsecurity=False`).
### Description
Adds a comment explaining why SHA-1 is required here and annotates the
call so static analysis does not flag it. No behavior change.
Note: MSAL itself carries the same annotation on its own `x5t`
fingerprint computation.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
---------
Co-authored-by: Copilot App <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
Copilot-Session: d2b7d3e7-a125-4569-b976-a6534c1837ae
Bumps the pinned .NET SDK version in `dotnet/global.json` from 10.0.301
to the patched 10.0.302 release to mitigate a security vulnerability in
older 10.0 SDKs. Version-only change; no functional impact. See
https://aka.ms/dotnet-security-notes for details.
Co-authored-by: Copilot <[email protected]>
Copilot-Session: 3905f237-3424-4ddd-93e4-47c05dd840ce
Bumps the transitively-resolved form-data dependency from 4.0.5 to the
patched 4.0.6 in the ProcessFrameworkWithSignalR React frontend.
Lock-file only change; no functional impact.
---------
Copilot-Session: fdaae27a-1dfe-4ed4-9704-c4b8f6c7ecd7
### Motivation and Context
MCP tool and prompt name normalization is many-to-one, so two remote
names can produce the same local name. The second registration silently
replaced the first.
### Description
Track normalized names already registered by the plugin and skip
colliding tools or prompts with a warning instead of overwriting.
Reloading the same remote item still refreshes it. Adds unit tests.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines
- [x] All unit tests pass, and I have added new tests where possible
---------
Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 4cab25f4-d987-42b3-bb34-e8d8a7185c80
Adds an inline CodeQL suppression comment for a confirmed false positive
in an internal HTTP utility method. Input validation is handled by
callers higher in the stack.
Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 5830be01-63d3-41f6-ae70-8ffeae81d46f
Pin `Microsoft.AspNetCore.OData` to version 9.5.0 in
`Directory.Packages.props`. This overrides the transitive dependency
brought in by `OData2Linq 2.2.0` used in the Entity Framework structured
data plugin.
Co-authored-by: Copilot App <[email protected]>
Copilot-Session: a8efdd59-6d18-4194-8561-1d4144f87333
Minor robustness and hygiene improvements to how the dotnet-format
workflow passes values to the shell. No functional change to the
formatting behavior.
---------
Copilot-Session: b0794c00-ed83-4259-8d12-26df4b836393
### Motivation and Context
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
### Motivation and Context
`Microsoft.SemanticKernel.Connectors.*` vector store packages are moving
to `CommunityToolkit.VectorData.*`. This updates the `VectorStoreRAG`
and `Concepts` sample projects to reference the new package IDs and
namespaces.
### Description
**Package reference updates** (`Directory.Packages.props`,
`VectorStoreRAG.csproj`, `Concepts.csproj`):
| Old | New | Version |
|-----|-----|---------|
| `Microsoft.SemanticKernel.Connectors.AzureAISearch` |
`CommunityToolkit.VectorData.AzureAISearch` | 1.0.0 |
| `Microsoft.SemanticKernel.Connectors.CosmosMongoDB` |
`CommunityToolkit.VectorData.CosmosMongoDB` | 1.0.0 |
| `Microsoft.SemanticKernel.Connectors.CosmosNoSql` |
`CommunityToolkit.VectorData.CosmosNoSql` | 1.0.0 |
| `Microsoft.SemanticKernel.Connectors.InMemory` |
`CommunityToolkit.VectorData.InMemory` | 1.0.0 |
| `Microsoft.SemanticKernel.Connectors.PgVector` |
`CommunityToolkit.VectorData.PgVector` | 1.0.0 |
| `Microsoft.SemanticKernel.Connectors.Qdrant` |
`CommunityToolkit.VectorData.Qdrant` | 1.0.0 |
| `Microsoft.SemanticKernel.Connectors.Redis` |
`CommunityToolkit.VectorData.Redis` | 1.0.0 |
| `Microsoft.SemanticKernel.Connectors.Weaviate` |
`CommunityToolkit.VectorData.Weaviate` | 1.0.0 |
**Namespace updates** :
```csharp
// Before
using Microsoft.SemanticKernel.Connectors.InMemory;
// After
using CommunityToolkit.VectorData.InMemory;
```
DI extension methods (`AddInMemoryVectorStore`, `AddQdrantCollection`,
etc.) moved to `Microsoft.Extensions.DependencyInjection` in the CT
packages — all affected files already had that `using`, so no additional
changes needed there.
**API compatibility fixes:**
- `[VectorStoreVector(Dimensions: N)]` → `[VectorStoreVector(N)]` in two
files — the new `Microsoft.Extensions.VectorData.Abstractions`
constructor uses a positional parameter named `dimensions` (lowercase),
so the old named-argument form no longer compiles.
- `SharpCompress` pin bumped `0.48.0` → `0.48.1` in
`Directory.Packages.props` — `CommunityToolkit.VectorData.CosmosMongoDB`
pulls `MongoDB.Driver 3.10.0` which requires `>= 0.48.1`.
- Added
`<AzureCosmosDisableNewtonsoftJsonCheck>true</AzureCosmosDisableNewtonsoftJsonCheck>`
to both sample csproj files — `CommunityToolkit.VectorData.CosmosNoSql`
pulls `Microsoft.Azure.Cosmos 3.61.0` which added a mandatory
Newtonsoft.Json explicit-reference check not present in the prior
version.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
---------
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: Adam Sitnik <[email protected]>
Closes#14111
## Summary
- Adds a `TimeProvider` constructor parameter to `TimePlugin` (defaults
to `TimeProvider.System`, so all existing callers are unaffected)
- Replaces all direct `DateTimeOffset.Now` / `DateTimeOffset.UtcNow`
calls with `_timeProvider.GetLocalNow()` / `_timeProvider.GetUtcNow()`
- Rewrites `TimePluginTests` from 5 real-clock tests to 26 deterministic
tests covering every public method, using an inline
`FixedUtcTimeProvider` subclass (no new test dependencies)
## Key decisions
| Decision | Reason |
|---|---|
| `System.TimeProvider` (not a custom `IClock`) | Standard .NET 8+
pattern; no extra abstraction needed |
| Inline `FixedUtcTimeProvider` subclass in tests | Avoids adding
`Microsoft.Extensions.TimeProvider.Testing` as a new dependency; 3-line
subclass is clearer |
| `LocalTimeZone = TimeZoneInfo.Utc` on the test provider | Makes test
output identical on any machine regardless of OS timezone |
| Default `TimeProvider.System` in constructor | Zero breaking change —
all existing callers (`new TimePlugin()`) work unchanged |
## Test results
```
Passed! - Failed: 0, Passed: 394, Skipped: 0, Total: 394
```
---------
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
Co-authored-by: westey <[email protected]>
### Motivation and Context
`FileIOPlugin` and `WebFileDownloadPlugin` rejected only some UNC path
prefixes before path canonicalization. On Windows, mixed `/\` and `\/`
prefixes resolve to UNC paths too, so those forms could reach filesystem
path resolution before the allow-list rejected them.
Fixes#14157.
### Description
- Treat any two leading `/` or `\` characters as a UNC or extended-path
prefix in both plugins.
- Reject those paths before canonicalization, `File.Exists`, or
`File.GetAttributes` can probe the filesystem.
- Add read, write, and download regressions for all four separator
combinations.
The change is limited to the two plugins named in the issue.
Single-separator rooted paths, normal local paths, allow-list behavior,
symlink handling, overwrite checks, and download limits are unchanged.
### Verification
```bash
dotnet test dotnet/src/Plugins/Plugins.UnitTests/Plugins.UnitTests.csproj --filter "FullyQualifiedName~ItRejectsUncOrExtendedPathsOnReadAsync|FullyQualifiedName~ItRejectsUncOrExtendedPathsOnWriteAsync|FullyQualifiedName~DownloadToFileRejectsUncOrExtendedPathsAsync"
dotnet test dotnet/src/Plugins/Plugins.UnitTests/Plugins.UnitTests.csproj --filter "FullyQualifiedName~FileIOPluginTests"
dotnet test dotnet/src/Plugins/Plugins.UnitTests/Plugins.UnitTests.csproj --filter "FullyQualifiedName!~DownloadToFileSucceedsAsync&FullyQualifiedName!~DownloadToFileFailsForInvalidParametersAsync"
dotnet format dotnet/src/Plugins/Plugins.UnitTests/Plugins.UnitTests.csproj --verify-no-changes --no-restore
```
The focused regressions pass 12/12, all `FileIOPluginTests` pass 21/21,
and the deterministic Plugins unit-test suite passes 409/409. The two
excluded Web tests use a live HTTPS request and fail on unmodified
`main` in this macOS environment because certificate revocation status
is unavailable.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
(409 deterministic tests pass; two live-network baseline tests are
environment-limited as noted above)
- [x] I didn't break anyone 😄
---------
Signed-off-by: King Star <[email protected]>
Co-authored-by: Roger Barreto <[email protected]>
## Motivation and Context
CI (`dotnet-build-and-test`) currently fails repo-wide on **NU1903**:
`Prompty.Core` `0.2.3-beta` has a known high severity advisory
[GHSA-wxhm-2mq7-7697](https://github.com/advisories/GHSA-wxhm-2mq7-7697)
(path traversal in `${file:...}` reference expansion). The build treats
the audit as an error (`--warnaserror`), so this blocks every .NET PR.
The advisory is fixed in `Prompty.Core` **2.0.0-beta.2+**. That release
is a significant rewrite: it targets **net9.0 only** and ships a new
`.prompty` spec and API. There is no intermediate 0.x fix, so resolving
the advisory requires this upgrade.
## Description
Upgrades `Prompty.Core` `0.2.3-beta` → `2.0.0-beta.3` and adapts
Semantic Kernel to the 2.0 surface.
- **Package**: bump `Prompty.Core` in `Directory.Packages.props`; remove
the `Scriban` workaround reference (2.0 no longer depends on it).
- **Target frameworks**: retarget `Functions.Prompty` to `net10.0` only.
The fixed package is net9.0-only, so `net8.0` and `netstandard2.0` can
no longer be supported.
- **Loader migration** (`KernelFunctionPrompty`):
- Text input: `FrontmatterParser.Parse` + `Prompty.Load`.
- File input: secure `PromptyLoader.Load` with `AllowedFileRoots` scoped
to the prompty file's directory, so `${file:...}` references are
confined (the fix for the advisory).
- Parse failures are normalized to `ArgumentException` to preserve the
input-validation contract.
- **Test data + tests**: migrate the `.prompty` files to the 2.0 spec
(`apiType`, list-form `inputs`, renamed `options`) and update
`PromptyTests` accordingly.
- **Samples**: update the `Concepts` inline templates to the 2.0 spec.
## ⚠️ Breaking changes
`Microsoft.SemanticKernel.Prompty` is a preview (`-beta`) package. This
change:
- **Drops `net8.0` and `netstandard2.0`** support (now `net10.0` only).
- Requires `.prompty` files to use the **2.0 spec** (`model.apiType`,
`model.provider`, `connection.kind`, `inputs`/`outputs` as lists,
renamed `model.options`). v1 files are not auto-migrated. See the
[Prompty v1→v2 migration guide](https://www.prompty.ai/migration/).
- No longer surfaces the following, which are not part of the 2.0 model:
input/output `json_schema`, connection `service_id`, and arbitrary
`model.options` passthrough beyond the strongly typed set.
## Validation
- `Functions.Prompty.UnitTests`: **22/22 pass** (Release,
`--warnaserror`).
- `Functions.Prompty` and `Concepts` build clean, **no NU1903**.
- `dotnet format --verify-no-changes` clean on changed projects.
- Behavior coherence: rendered prompt output for the `Concepts` samples
is **byte-for-byte identical** to the previously published package, and
the samples were run end-to-end against a live model with the expected
results.
## Contribution Checklist
- [x] The code builds clean without errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
- [x] All unit tests pass, and I have added/updated tests where possible
- [x] I didn't break anyone 😄
Fixes#13922
## Problem
Three static analysis issues identified by PVS-Studio in the .NET
codebase:
1. **`ClientCore.ChatCompletion.cs`** — `GetAudioOutputMimeType`
contained a duplicate `ChatOutputAudioFormat.Wav` check (lines 985 and
1000) making the second branch unreachable. The `Aac` audio format
supported by the OpenAI SDK was silently unhandled, causing a
`NotSupportedException` at runtime.
2. **`TextSearchStore.cs`** — `GetTextSearchResultsAsync` assigned a
LINQ expression to a `results` variable (deferred execution) that was
never iterated. The return statement duplicated the projection. The
unused variable was dead code.
3. **`KernelProcess.cs`** — The constructor accepted a `threads`
parameter but never assigned it to the `Threads` property, silently
discarding all threads passed by callers.
## Solution
1. Replace the second `Wav` branch with an `Aac` branch and update the
error message to list `'aac'` as a supported format.
2. Reuse the `results` variable in the `return` statement instead of
duplicating the `Select` projection.
3. Assign the `threads` parameter to `this.Threads` when it is not null.
## Testing
- Changes are logic-only with no new external dependencies.
- Existing unit tests for `OpenAIChatCompletionService` and
`TextSearchStore` continue to apply.
- No new runtime behaviour is introduced for the `Wav` fix (it was
already handled earlier in the method); `Aac` now maps to `"audio/aac"`
as expected.
---------
Co-authored-by: octo-patch <[email protected]>
Co-authored-by: Roger Barreto <[email protected]>
## Summary
- Adds `Think` (`bool?`) property to `OllamaPromptExecutionSettings` to
control thinking for Ollama reasoning models (deepseek-r1, qwen3,
phi4-reasoning)
- Maps `Think` to `GenerateRequest.Think` in
`OllamaTextGenerationService.CreateRequest()`
- Bumps OllamaSharp from 5.4.12 to 5.4.25 which introduces
`GenerateRequest.Think`
## Motivation
Fixes#14078. When a reasoning model has thinking enabled by default
(e.g. qwen3, phi4-reasoning), the model output lands in a separate
thinking stream rather than the standard response field. This causes
`GetTextContentsAsync` to return empty content. The only way to get a
usable response is to pass `think=false` to suppress thinking, but there
was no way to set that from `OllamaPromptExecutionSettings`.
## Changes
### `OllamaPromptExecutionSettings.cs`
- New `Think` property with `bool?` type, JSON name `think`,
`WhenWritingNull` ignore condition, `ThrowIfFrozen()` guard, and
`Clone()` support
### `OllamaTextGenerationService.cs`
- `CreateRequest()` maps `settings.Think` to `GenerateRequest.Think`
using `OllamaSharp.Models.Chat.ThinkValue`
### `Directory.Packages.props`
- OllamaSharp bumped from 5.4.12 to 5.4.25 (adds `GenerateRequest.Think`
and `ThinkValue`)
### Tests
- `OllamaPromptExecutionSettingsTests`: serialization round-trip, Clone,
Freeze guard for `Think`
- `OllamaTextGenerationTests`: verifies `Think` is present/absent in the
serialized request payload for both `GetTextContentsAsync` and
`GetStreamingTextContentsAsync`
## Test plan
- [ ] All 115 existing unit tests pass (1 pre-existing skip)
- [ ] `ThinkPropertyRoundTripsViaSerialization` - `true`/`false`
round-trips via JSON
- [ ] `ThinkPropertyIsPreservedByClone` - Clone copies the value
- [ ] `ThinkPropertyThrowsWhenFrozen` - setter throws after Freeze
- [ ] `GetTextContentsShouldSendThinkSettingAsync` - request payload
contains correct `think` field
- [ ] `GetTextContentsShouldNotSendThinkWhenNotSetAsync` - request
payload omits `think` when null
- [ ] `GetStreamingTextContentsShouldSendThinkSettingAsync` - streaming
path also sends `think`
---------
Co-authored-by: Roger Barreto <[email protected]>
Bumps the SK package version in preparation for the next release.
- VersionPrefix: 1.77.0 -> 1.78.0
- PackageValidationBaselineVersion: 1.76.0 -> 1.77.0
---------
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
Bumps the Python package version for the next release.
### Description
Updates `semantic_kernel.__version__` from `1.43.1` to `1.44.0`.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines and the
pre-submission formatting script raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I did not break anyone 😄
## Motivation and Context
The OpenAPI plugin imports operations from a spec and lets the host
restrict which operations are exposed via an
`OperationSelectionPredicate` (and via `OperationsToExclude`). Operation
selection and request-URL construction should share one canonical
interpretation of an operation path. This change closes two consistency
gaps where a spec-supplied path could be interpreted differently at
selection time than at request time.
1. **Selection vs. request path normalization.** The selection predicate
received the raw operation path, while the request URL is built from a
canonicalized path. An encoded dot-segment (for example `%2e%2e`) is
textually different from the endpoint it canonicalizes to, so it could
pass a path-based include/exclude filter yet resolve to a different
route. Operations whose path contains an encoded or literal dot-segment
are now excluded before the predicate is consulted, symmetric with the
existing request-time dot-segment rejection.
2. **Request target reconciliation (defense in depth).** After the
request URL is built, verify it did not move off the configured server.
An operation path that is an absolute or authority-changing URI (for
example `https://another-host/admin`) carries no dot-segment, so it
passes path-segment validation, yet `System.Uri` / `urljoin` resolve it
to a different scheme, host, or port. Such a request is now rejected
before it is sent, so a credential-bearing request cannot be redirected
to an unintended target.
Both changes are applied symmetrically to the .NET and Python OpenAPI
ports.
## Description
- **.NET**
- `OpenApiDocumentParser` skips operations whose path contains a
dot-segment before invoking the selection predicate.
- `RestApiOperation` extracts a shared `ContainsDotSegment` helper
(reused by the existing `ValidatePathSegments`) and, after building the
request URL, reconciles its scheme/host/port and base path against the
configured server.
- **Python**
- `openapi_parser` skips dot-segment operations before the predicate
runs.
- `rest_api_operation` adds a shared `_contains_dot_segment` helper and
a post-construction `_ensure_request_target_matches_server`
reconciliation.
## Tests
- .NET: added selection-exclusion and request-target reconciliation
tests; full `Functions.UnitTests` OpenApi suite green (488).
- Python: added parity tests for both behaviors;
`tests/unit/connectors/openapi_plugin` green (173), ruff + ruff-format +
mypy + pre-commit clean.
## Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines
- [x] All unit tests pass, and I have added new tests where possible
The default HTTP clients used by `HttpPlugin` and
`WebFileDownloadPlugin` now have `AllowAutoRedirect` set to `false`.
This ensures the `AllowedDomains` restriction is enforced consistently
regardless of server responses.
- Added `GetNonRedirectingHttpClient()` to `HttpClientProvider` (all
target frameworks)
- Updated both plugins to use non-redirecting clients by default
- Added unit tests verifying redirect responses are not followed
- Updated XML documentation
Co-authored-by: Copilot <[email protected]>
Fixes CI failure caused by NU1902 errors due to known moderate severity
vulnerabilities in Scriban 7.2.0 (GHSA-6q7j-xr26-3h2c,
GHSA-q6rr-fm2g-g5x8).
Co-authored-by: Copilot <[email protected]>
## Motivation and Context
The Python MCP server demos under `python/samples/demos/mcp_server/` can
optionally run over the SSE transport (`--transport sse`). This updates
that sample wiring to follow the Model Context Protocol guidance for
local development servers, so developers who use these demos as a
starting point inherit sensible defaults.
## Description
- **Loopback by default**: the SSE samples now bind to `127.0.0.1`
instead of `0.0.0.0`. A new `--host` argument makes binding to other
interfaces an explicit opt-in that logs a warning.
- **Host/Origin validation**: added Starlette `TrustedHostMiddleware`
plus a small Origin allowlist middleware so the local listener only
serves loopback callers (requests without an `Origin` header are still
allowed, for non-browser MCP clients).
- **Sample hygiene**: switched `Starlette(debug=True)` to `debug=False`
so the demos don't ship verbose debug output.
- **Docs**: the README now describes the loopback-by-default behavior,
the `--host` opt-in, and points to the existing `mcp_with_oauth` sample
for authenticated, network-reachable deployments.
Applies to `sk_mcp_server.py` and `agent_as_server.py`. The stdio
transport (the default) and the other stdio-only samples are unchanged.
## Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] I didn't break anyone 😄
---------
Co-authored-by: Copilot <[email protected]>
### Motivation and Context
The MCP server created by `create_mcp_server_from_kernel` (and the
`Kernel.as_mcp_server` wrapper) accepts an `excluded_functions` argument
to keep selected kernel functions off the server. Previously this list
was applied only when building the tool set advertised by the
`list_tools` handler; the `call_tool` handler did not consult it and
forwarded the client-supplied name straight to the kernel. As a result
the set of advertised tools and the set of callable tools could diverge.
### Description
- Derive a single `exposed_names` set from `functions_to_expose` and
check it in the `call_tool` handler, returning a `METHOD_NOT_FOUND`
error for any name that is not exposed.
- Remove a leftover `print` debug statement in `_call_kernel_function`.
- Add a unit test covering the `call_tool` behavior for a non-exposed
function.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines
- [x] All unit tests pass, and I have added new tests where possible
---------
Co-authored-by: Copilot <[email protected]>
