mirror of
https://github.com/microsoft/semantic-kernel.git
synced 2026-10-12 02:19:06 +00:00
dotnet-1.80.1
1287
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
|
b371cc6c6f |
Python: update dependencies (#14360)
## Summary - update Transformers and related Hugging Face packages - refresh Python dependencies used by the MCP OAuth demo - regenerate the affected uv lockfiles - adapt the Hugging Face text completion connector to Transformers 5 - temporarily disable live tests that depend on the retired Assistants API ## Hugging Face connector Transformers 5 removes the `text2text-generation`, `summarization` and `translation` pipeline tasks, so `HuggingFaceTextCompletion` raised `KeyError: Unknown task text2text-generation` on construction. Those two tasks now use a small adapter built on `AutoModelForSeq2SeqLM` and `AutoTokenizer` that preserves what the removed pipelines did: - the same output keys (`summary_text` for summarization, `generated_text` otherwise), so the content mapping is unchanged - the model's task specific prefix (e.g. `summarize: `) is still prepended before tokenization - one record per generated sequence when `num_return_sequences > 1` - `model_kwargs` are shared with the tokenizer load, as `pipeline()` did - pipeline only options are dropped with a warning instead of reaching `generate()` `text-generation` keeps using `pipeline()`. There is no public API change. The previous unit tests mocked `pipeline()` and so did not catch the incompatibility. New tests cover the adapter, option routing, device placement, output mapping and prefix resolution. ## Temporarily disabled tests The OpenAI and Azure OpenAI Assistants API has been retired. Live requests now return HTTP 410 (`assistants_api_deprecated`) on Azure OpenAI and HTTP 404 on OpenAI, so these tests cannot exercise a functioning service. - all 30 parametrized cases in `tests/integration/agents/openai_assistant_agent/test_openai_assistant_agent_integration.py` are skipped at module level, before the live-service fixture runs - the `step1_openai_assistant` case in `tests/samples/test_concepts.py` is skipped unconditionally - the other concept samples are unchanged - all 103 tests under `tests/unit/agents/openai_assistant` remain enabled and passing The skips are intentionally limited to live tests for the retired API. Comments next to each skip include the migration guide and state that the skip should be removed after the agents and sample move to the replacement API. ## Validation - uv lock consistency checks - 35 Hugging Face unit tests pass - all 12 deliberate connector mutations used to assess regression coverage were detected by the unit tests - all 103 Assistants agent unit tests pass - 30 live Assistants integration cases and the one retired-API concept sample report as skipped before making service requests - the three text completion services used by the integration suite were exercised against their real models on Transformers 5, for both completion and streaming - Ruff check and formatting pass --------- Co-authored-by: Evan Mattson <[email protected]> Co-authored-by: Copilot App <[email protected]> Copilot-Session: c2d4dd29-0a9c-4f43-b2ce-243e19ec34b2 |
||
|
SergeyMenshykh
|
6da62d372a |
Python: update MCP OAuth sample dependencies (#14352)
### Motivation and Context Keep the MCP OAuth demo aligned with the current Semantic Kernel Python SDK release and public API signatures. ### Description - Update the sample's Semantic Kernel dependency to 1.44.1. - Refresh the lockfile for the updated dependency graph. - Align timeout and agent-thread type annotations with the current SDK APIs. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All applicable checks pass; no new unit tests are needed for this sample dependency update - [x] I didn't break anyone 😄 --------- Copilot-Session: 71b0555a-bf39-4b88-8ff9-9a1178453c1b |
||
|
Vincent BiretandCopilot Autofix powered by AI
|
b4b0ae7780 |
chore: fixes typos (#14343)
fixes typos across repo that were flagged by the CI --------- Co-authored-by: Copilot Autofix powered by AI <[email protected]> |
||
|
SergeyMenshykh
|
b39d95a344 |
Python: [Breaking] Remove unsupported service auth mode from Copilot Studio agent (#14306)
### Motivation and Context The Copilot Studio agent exposed a `SERVICE` authentication mode that was never reachable — it was guarded to always raise before its implementation ran. Its dormant credential handling also triggered certificate-related static analysis alerts. ### Description Removes the service authentication path along with its settings, parameters, tests, and documentation. `CopilotStudioAgentAuthMode` is kept with its `INTERACTIVE` member, which is the only supported mode. Interactive authentication is unchanged. Service authentication can be reintroduced later as a complete, tested feature. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 --------- Copilot-Session: 25dd6e2a-f759-4148-a630-40110e90eff2 |
||
|
Evan Mattson
|
6e102255f1 |
Python: Bump Python version to 1.44.1 for a release (#14277)
### Motivation and Context Bump Python version to 1.44.1 for a release <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Bump Python version to 1.44.1 for a release <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [X] I didn't break anyone 😄 |
||
|
|
8ec7dddd9a |
Python: Document x5t certificate thumbprint hashing in Copilot Studio agent (#14270)
### Motivation and Context `_CopilotStudioAgentTokenFactory._cert_thumbprint` computes the X.509 certificate thumbprint that is passed to MSAL as the `thumbprint` client credential. This value is the JWT `x5t` header, which MSAL and Microsoft Entra ID require to be a SHA-1 digest - any other digest would be rejected by the token endpoint. Because it is a plain digest call, static analysis tooling flags it even though the hash is used purely as a certificate identifier, not as a cryptographic/security primitive (the call already passes `usedforsecurity=False`). ### Description Adds a comment explaining why SHA-1 is required here and annotates the call so static analysis does not flag it. No behavior change. Note: MSAL itself carries the same annotation on its own `x5t` fingerprint computation. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 --------- Co-authored-by: Copilot App <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]> Copilot-Session: d2b7d3e7-a125-4569-b976-a6534c1837ae |
||
|
SergeyMenshykhandCopilot App
|
b5877044eb |
Python: Skip MCP tools and prompts whose normalized names collide (#14236)
### Motivation and Context MCP tool and prompt name normalization is many-to-one, so two remote names can produce the same local name. The second registration silently replaced the first. ### Description Track normalized names already registered by the plugin and skip colliding tools or prompts with a warning instead of overwriting. Reloading the same remote item still refreshes it. Adds unit tests. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the SK Contribution Guidelines - [x] All unit tests pass, and I have added new tests where possible --------- Co-authored-by: Copilot App <[email protected]> Copilot-Session: 4cab25f4-d987-42b3-bb34-e8d8a7185c80 |
||
|
Evan Mattson
|
7d885ddac1 |
Consolidate Python and .NET dependency updates (#14222)
### Motivation and Context Consolidates the currently open Python and .NET Dependabot updates into one coordinated dependency change. This reduces duplicate review and CI work while preserving each source PR's update intent. The npm and Yarn updates are intentionally excluded from this draft and remain in their original Dependabot PRs. ### Related Issue Supersedes: - https://github.com/microsoft/semantic-kernel/pull/14178 - https://github.com/microsoft/semantic-kernel/pull/14184 - https://github.com/microsoft/semantic-kernel/pull/14185 - https://github.com/microsoft/semantic-kernel/pull/14186 - https://github.com/microsoft/semantic-kernel/pull/14187 - https://github.com/microsoft/semantic-kernel/pull/14188 - https://github.com/microsoft/semantic-kernel/pull/14189 - https://github.com/microsoft/semantic-kernel/pull/14191 - https://github.com/microsoft/semantic-kernel/pull/14192 - https://github.com/microsoft/semantic-kernel/pull/14202 - https://github.com/microsoft/semantic-kernel/pull/14203 - https://github.com/microsoft/semantic-kernel/pull/14204 - https://github.com/microsoft/semantic-kernel/pull/14205 - https://github.com/microsoft/semantic-kernel/pull/14207 - https://github.com/microsoft/semantic-kernel/pull/14208 - https://github.com/microsoft/semantic-kernel/pull/14211 - https://github.com/microsoft/semantic-kernel/pull/14212 - https://github.com/microsoft/semantic-kernel/pull/14213 - https://github.com/microsoft/semantic-kernel/pull/14214 - https://github.com/microsoft/semantic-kernel/pull/14215 - https://github.com/microsoft/semantic-kernel/pull/14216 - https://github.com/microsoft/semantic-kernel/pull/14217 - https://github.com/microsoft/semantic-kernel/pull/14218 - https://github.com/microsoft/semantic-kernel/pull/14219 - https://github.com/microsoft/semantic-kernel/pull/14221 ### Description - Updates the selected .NET Aspire and AWS SDK package versions in central package management. - Updates the selected Python requirements and regenerates both affected uv lockfiles without losing earlier bumps. - Keeps the compatible ONNX Runtime/GenAI pair on Python 3.10 while applying ONNX Runtime GenAI 0.14.1 on Python 3.11 and newer. - Retains pyOpenSSL 26.2.0, which is newer than the 26.0.0 requested by its source PR and is required by the consolidated cryptography update. - Uses Pinecone 7.3 or newer on Windows, where Pinecone 7.0.1 imports the unavailable Unix `readline` module, while retaining the existing `~=7.0` range on macOS and Linux. - Constrains MCP to the compatible 1.x API because the current Semantic Kernel integration imports interfaces removed by MCP 2.0. ### Validation - Python unit tests passed across Python 3.10-3.13 on Ubuntu, Windows, and macOS, including Dapr jobs. - Python pre-commit, lock validation, spell checking, and integration-test aggregate checks passed. - .NET 9/10 builds, package-install checks, unit tests, AOT tests, formatting, and coverage checks passed on Ubuntu and Windows. - Merge Gatekeeper passed. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 |
||
|
SergeyMenshykh
|
3da48a3d01 |
Python: [Breaking] Add MCP tool approval callback for Azure AI Agent (#14210)
## Summary - Add an Azure AI Agent callback for MCP tool approval requests. - Route MCP tool approval submissions through a shared helper in thread actions. - Add unit coverage for approval, denial, callback failures, and per-call decisions. ## Testing - python -m pytest tests/unit/agents/azure_ai_agent --------- Copilot-Session: 3e190979-228b-4a82-8e63-5ad14bd4879f |
||
|
westey
|
7481cd062b |
Fix cosmosdb vectorstore bug (#14182)
### Motivation and Context <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
|
d003eb2590 |
Consolidate Dependabot dependency updates (#14176)
### Motivation and Context Semantic Kernel currently has 43 open Dependabot pull requests spanning GitHub Actions, .NET, Python, npm, and Yarn dependency graphs. This rollup applies their compatible net changes together on the latest `main`, making it possible to validate and merge the updates as one coherent dependency state. Supersedes: - https://github.com/microsoft/semantic-kernel/pull/13133 - https://github.com/microsoft/semantic-kernel/pull/13134 - https://github.com/microsoft/semantic-kernel/pull/13136 - https://github.com/microsoft/semantic-kernel/pull/13172 - https://github.com/microsoft/semantic-kernel/pull/13507 - https://github.com/microsoft/semantic-kernel/pull/13601 - https://github.com/microsoft/semantic-kernel/pull/13606 - https://github.com/microsoft/semantic-kernel/pull/13666 - https://github.com/microsoft/semantic-kernel/pull/13673 - https://github.com/microsoft/semantic-kernel/pull/13688 - https://github.com/microsoft/semantic-kernel/pull/13700 - https://github.com/microsoft/semantic-kernel/pull/13707 - https://github.com/microsoft/semantic-kernel/pull/13708 - https://github.com/microsoft/semantic-kernel/pull/13712 - https://github.com/microsoft/semantic-kernel/pull/13721 - https://github.com/microsoft/semantic-kernel/pull/13873 - https://github.com/microsoft/semantic-kernel/pull/13930 - https://github.com/microsoft/semantic-kernel/pull/13939 - https://github.com/microsoft/semantic-kernel/pull/13949 - https://github.com/microsoft/semantic-kernel/pull/13950 - https://github.com/microsoft/semantic-kernel/pull/13951 - https://github.com/microsoft/semantic-kernel/pull/13997 - https://github.com/microsoft/semantic-kernel/pull/14000 - https://github.com/microsoft/semantic-kernel/pull/14053 - https://github.com/microsoft/semantic-kernel/pull/14069 - https://github.com/microsoft/semantic-kernel/pull/14088 - https://github.com/microsoft/semantic-kernel/pull/14091 - https://github.com/microsoft/semantic-kernel/pull/14094 - https://github.com/microsoft/semantic-kernel/pull/14103 - https://github.com/microsoft/semantic-kernel/pull/14106 - https://github.com/microsoft/semantic-kernel/pull/14107 - https://github.com/microsoft/semantic-kernel/pull/14108 - https://github.com/microsoft/semantic-kernel/pull/14109 - https://github.com/microsoft/semantic-kernel/pull/14110 - https://github.com/microsoft/semantic-kernel/pull/14128 - https://github.com/microsoft/semantic-kernel/pull/14148 - https://github.com/microsoft/semantic-kernel/pull/14149 - https://github.com/microsoft/semantic-kernel/pull/14160 - https://github.com/microsoft/semantic-kernel/pull/14161 - https://github.com/microsoft/semantic-kernel/pull/14164 - https://github.com/microsoft/semantic-kernel/pull/14171 - https://github.com/microsoft/semantic-kernel/pull/14172 - https://github.com/microsoft/semantic-kernel/pull/14173 ### Description - Updates the requested GitHub Actions and preserves the PR-file-scoped typos workflow fix. - Consolidates the .NET Aspire, AWS SDK, ReportGenerator, JavaScript, and SQLite security updates. - Regenerates the npm, Yarn, and uv lockfiles from the combined manifests instead of resolving generated-file conflicts by selection. - Rolls overlapping updates forward to one compatible result: pyasn1 0.6.4 supersedes 0.6.3; pyOpenSSL 26.2.0 remains compatible with cryptography 48.0.1; and Vite 8/Rolldown makes the older Rollup-only overrides obsolete. - Retains updates already present on current `main` without reintroducing stale pins, including Aspire Hosting Azure Search 13.3.0 and Prompty.Core 2.0.0-beta.3. The full .NET solution builds in Debug with zero warnings and errors. Focused validation passed 82 .NET tests (3 skipped), 1,096 Python tests, both frontend production builds, and uv lock consistency checks for the main Python project and OAuth sample. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> |
||
|
Eduard van ValkenburgandCopilot
|
dd026f3413 |
Encode OpenAPI server variable values (#14146)
## Summary - validate enum-constrained OpenAPI server variables before substitution - percent-encode substituted server variable values, including defaults - add regression tests for invalid enum values and reserved-character encoding ## Testing - uv run pytest tests/unit/connectors/openapi_plugin/test_sk_openapi.py -q --------- Co-authored-by: Copilot <[email protected]> |
||
|
Evan Mattson
|
e4025c3446 |
Python: Bump Python version to 1.44.0 for a release (#14141)
### Motivation and Context
Bumps the Python package version for the next release.
### Description
Updates `semantic_kernel.__version__` from `1.43.1` to `1.44.0`.
### Contribution Checklist
- [x] The code builds clean without any errors or warnings
- [x] The PR follows the SK Contribution Guidelines and the
pre-submission formatting script raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I did not break anyone 😄
|
||
|
|
3df33f7862 |
Python: [Breaking] Update runtime handling (#14135)
This PR updates Python runtime handling and related tests. --------- Co-authored-by: Copilot <[email protected]> Co-authored-by: Evan Mattson <[email protected]> |
||
|
Roger Barreto
|
f6391ad8b6 |
Python: OpenApi: Harden operation path handling for consistent selection and request targeting (.Net & Python) (#14140)
## Motivation and Context The OpenAPI plugin imports operations from a spec and lets the host restrict which operations are exposed via an `OperationSelectionPredicate` (and via `OperationsToExclude`). Operation selection and request-URL construction should share one canonical interpretation of an operation path. This change closes two consistency gaps where a spec-supplied path could be interpreted differently at selection time than at request time. 1. **Selection vs. request path normalization.** The selection predicate received the raw operation path, while the request URL is built from a canonicalized path. An encoded dot-segment (for example `%2e%2e`) is textually different from the endpoint it canonicalizes to, so it could pass a path-based include/exclude filter yet resolve to a different route. Operations whose path contains an encoded or literal dot-segment are now excluded before the predicate is consulted, symmetric with the existing request-time dot-segment rejection. 2. **Request target reconciliation (defense in depth).** After the request URL is built, verify it did not move off the configured server. An operation path that is an absolute or authority-changing URI (for example `https://another-host/admin`) carries no dot-segment, so it passes path-segment validation, yet `System.Uri` / `urljoin` resolve it to a different scheme, host, or port. Such a request is now rejected before it is sent, so a credential-bearing request cannot be redirected to an unintended target. Both changes are applied symmetrically to the .NET and Python OpenAPI ports. ## Description - **.NET** - `OpenApiDocumentParser` skips operations whose path contains a dot-segment before invoking the selection predicate. - `RestApiOperation` extracts a shared `ContainsDotSegment` helper (reused by the existing `ValidatePathSegments`) and, after building the request URL, reconciles its scheme/host/port and base path against the configured server. - **Python** - `openapi_parser` skips dot-segment operations before the predicate runs. - `rest_api_operation` adds a shared `_contains_dot_segment` helper and a post-construction `_ensure_request_target_matches_server` reconciliation. ## Tests - .NET: added selection-exclusion and request-target reconciliation tests; full `Functions.UnitTests` OpenApi suite green (488). - Python: added parity tests for both behaviors; `tests/unit/connectors/openapi_plugin` green (173), ruff + ruff-format + mypy + pre-commit clean. ## Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the SK Contribution Guidelines - [x] All unit tests pass, and I have added new tests where possible |
||
|
SergeyMenshykhandCopilot
|
38a5480af0 |
Python: Default MCP SSE server samples to loopback with host validation (#14127)
## Motivation and Context The Python MCP server demos under `python/samples/demos/mcp_server/` can optionally run over the SSE transport (`--transport sse`). This updates that sample wiring to follow the Model Context Protocol guidance for local development servers, so developers who use these demos as a starting point inherit sensible defaults. ## Description - **Loopback by default**: the SSE samples now bind to `127.0.0.1` instead of `0.0.0.0`. A new `--host` argument makes binding to other interfaces an explicit opt-in that logs a warning. - **Host/Origin validation**: added Starlette `TrustedHostMiddleware` plus a small Origin allowlist middleware so the local listener only serves loopback callers (requests without an `Origin` header are still allowed, for non-browser MCP clients). - **Sample hygiene**: switched `Starlette(debug=True)` to `debug=False` so the demos don't ship verbose debug output. - **Docs**: the README now describes the loopback-by-default behavior, the `--host` opt-in, and points to the existing `mcp_with_oauth` sample for authenticated, network-reachable deployments. Applies to `sk_mcp_server.py` and `agent_as_server.py`. The stdio transport (the default) and the other stdio-only samples are unchanged. ## Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] I didn't break anyone 😄 --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
efa3268a09 |
Python: Enforce excluded_functions on MCP tool invocation path (#14124)
### Motivation and Context The MCP server created by `create_mcp_server_from_kernel` (and the `Kernel.as_mcp_server` wrapper) accepts an `excluded_functions` argument to keep selected kernel functions off the server. Previously this list was applied only when building the tool set advertised by the `list_tools` handler; the `call_tool` handler did not consult it and forwarded the client-supplied name straight to the kernel. As a result the set of advertised tools and the set of callable tools could diverge. ### Description - Derive a single `exposed_names` set from `functions_to_expose` and check it in the `call_tool` handler, returning a `METHOD_NOT_FOUND` error for any name that is not exposed. - Remove a leftover `print` debug statement in `_call_kernel_function`. - Add a unit test covering the `call_tool` behavior for a non-exposed function. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the SK Contribution Guidelines - [x] All unit tests pass, and I have added new tests where possible --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
88e1060b99 |
Python: Adjust request validation (#14114)
Updates request validation behavior and related tests. --------- Co-authored-by: Copilot <[email protected]> |
||
|
Eduard van ValkenburgandCopilot
|
83bffe197b |
Python: Add OpenAPI server URL validation (#14097)
## Summary - Add server URL validation for Python OpenAPI operation execution before outbound requests are made - Add execution settings for trusted allowed base URLs and private-network access - Pass operation arguments into server variable resolution and add regression coverage for substituted server hosts ## Testing - `uv run pytest tests/unit/connectors/openapi_plugin/test_server_url_validator.py tests/unit/connectors/openapi_plugin/test_openapi_runner.py tests/unit/connectors/openapi_plugin/test_openapi_manager.py tests/unit/connectors/openapi_plugin/test_sk_openapi.py` - `uv run pytest tests/integration/cross_language/test_cross_language.py -k openapi` - `uv run ruff check ...` - `uv run ruff format --check ...` --------- Co-authored-by: Copilot <[email protected]> |
||
|
dependabot[bot]
|
00bad6fed1 |
Bump mistune from 3.2.0 to 3.2.1 in /python (#13965)
Bumps [mistune](https://github.com/lepture/mistune) from 3.2.0 to 3.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lepture/mistune/releases">mistune's releases</a>.</em></p> <blockquote> <h2>v3.2.1</h2> <h3> 🐞 Bug Fixes</h3> <ul> <li>Resolve Windows compatibility issues in file inclusion and tests - by <a href="https://github.com/Yuki9814"><code>@Yuki9814</code></a> <a href="https://github.com/lepture/mistune/commit/2547102"><!-- raw HTML omitted -->(25471)<!-- raw HTML omitted --></a></li> <li>Escape html text - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/a3cb6e5"><!-- raw HTML omitted -->(a3cb6)<!-- raw HTML omitted --></a></li> <li>Update link reference - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/85eb54f"><!-- raw HTML omitted -->(85eb5)<!-- raw HTML omitted --></a></li> <li>Handle escaped dollar signs in inline math - by <a href="https://github.com/saschabuehrle"><code>@saschabuehrle</code></a> in <a href="https://redirect.github.com/lepture/mistune/issues/370">lepture/mistune#370</a> <a href="https://github.com/lepture/mistune/commit/7bd5709"><!-- raw HTML omitted -->(7bd57)<!-- raw HTML omitted --></a></li> <li>Escape id of toc - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/04880a0"><!-- raw HTML omitted -->(04880)<!-- raw HTML omitted --></a></li> <li>Escape id of headings - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/2855622"><!-- raw HTML omitted -->(28556)<!-- raw HTML omitted --></a></li> <li>Remove double-encoding of image alt text - by <a href="https://github.com/lawrence3699"><code>@lawrence3699</code></a> <a href="https://github.com/lepture/mistune/commit/0d6f3d8"><!-- raw HTML omitted -->(0d6f3)<!-- raw HTML omitted --></a></li> <li>Escape xml for math plugin - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/5fa092e"><!-- raw HTML omitted -->(5fa09)<!-- raw HTML omitted --></a></li> <li>Use strict regex for image's height and width - by <a href="https://github.com/lepture"><code>@lepture</code></a> <a href="https://github.com/lepture/mistune/commit/8d0cb75"><!-- raw HTML omitted -->(8d0cb)<!-- raw HTML omitted --></a></li> </ul> <h5> <a href="https://github.com/lepture/mistune/compare/v3.2.0...v3.2.1">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/lepture/mistune/blob/main/docs/changes.rst">mistune's changelog</a>.</em></p> <blockquote> <h2>Version 3.2.1</h2> <p><strong>Released on May 3, 2026</strong></p> <ul> <li>Escape link in <code>render_toc_ul</code>.</li> <li>Escape text in math plugin.</li> <li>Fix regex for math plugin.</li> <li>Escape heading's ID attribute.</li> <li>Fix <code>LINK_TITLE_RE</code> to prevent DoS.</li> <li>Escape class attribute for admonition directive.</li> <li>Remove double-encoding of image alt text.</li> <li>Escape class attribute for image directive.</li> <li>Fix width/height attribute for image directive.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lepture/mistune/commit/067f90861088a496942f5eb43236135352b85d39"><code>067f908</code></a> chore: release 3.2.1</li> <li><a href="https://github.com/lepture/mistune/commit/bf5503067a7d8c3b065fb143f67a3a08eca77bb6"><code>bf55030</code></a> Merge pull request <a href="https://redirect.github.com/lepture/mistune/issues/438">#438</a> from saschabuehrle/fix/issue-370</li> <li><a href="https://github.com/lepture/mistune/commit/8d0cb7539a9ac82e633b98476b9922632eb8b948"><code>8d0cb75</code></a> fix: use strict regex for image's height and width</li> <li><a href="https://github.com/lepture/mistune/commit/5fa092e3053b86f16e4c49b9d3ba0b7ab63f09ab"><code>5fa092e</code></a> fix: escape xml for math plugin</li> <li><a href="https://github.com/lepture/mistune/commit/71ec9477ebfcf8dab0068804baf2c77461d77fbb"><code>71ec947</code></a> Merge pull request <a href="https://redirect.github.com/lepture/mistune/issues/440">#440</a> from lawrence3699/fix/image-alt-double-encoding</li> <li><a href="https://github.com/lepture/mistune/commit/0d6f3d850283d51e9c60e5a1b3c9343a18df3722"><code>0d6f3d8</code></a> fix: remove double-encoding of image alt text</li> <li><a href="https://github.com/lepture/mistune/commit/2855622d7fe235c6c805716edff943b5945d1eea"><code>2855622</code></a> fix: escape id of headings</li> <li><a href="https://github.com/lepture/mistune/commit/04880a004cb28318e5ebd7ee9e63c79fc9f9ed04"><code>04880a0</code></a> fix: escape id of toc</li> <li><a href="https://github.com/lepture/mistune/commit/7bd57096715385062505b3f78972be9fa823d6d4"><code>7bd5709</code></a> fix: handle escaped dollar signs in inline math (fixes <a href="https://redirect.github.com/lepture/mistune/issues/370">#370</a>)</li> <li><a href="https://github.com/lepture/mistune/commit/85eb54ff17da26327399bf188f9ff9b8fd515278"><code>85eb54f</code></a> fix: update link reference</li> <li>Additional commits viewable in <a href="https://github.com/lepture/mistune/compare/v3.2.0...v3.2.1">compare view</a></li> </ul> </details> <br /> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
16085866f8 |
Bump urllib3 from 2.6.3 to 2.7.0 in /python (#13978)
### Motivation and Context Bumps <a href="https://github.com/urllib3/urllib3">urllib3</a> from 2.6.3 to 2.7.0 across the Python project, including the `mcp_with_oauth` demo, to pick up the latest security and bug fixes. ### Description - Bumps `urllib3` from 2.6.3 to 2.7.0 in `python/uv.lock` - Bumps `urllib3` from 2.5.0 to 2.7.0 in `python/samples/demos/mcp_with_oauth/uv.lock` so the demo no longer resolves an older urllib3 version ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: Evan Mattson <[email protected]> |
||
|
dependabot[bot]
|
22ee3e0032 |
Python: Bump authlib from 1.6.11 to 1.6.12 in /python (#14004)
Bumps [authlib](https://github.com/authlib/authlib) from 1.6.11 to 1.6.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/authlib/authlib/releases">authlib's releases</a>.</em></p> <blockquote> <h2>v1.6.12</h2> <ul> <li> <ul> <li>Fix redirecting to unvalidated <code>redirect_uri</code> on <code>InvalidScopeError</code> in <code>OpenIDImplicitGrant</code> and <code>OpenIDHybridGrant</code>. <strong>Full Changelog</strong>: <a href="https://github.com/authlib/authlib/compare/v1.6.11...v1.6.12">https://github.com/authlib/authlib/compare/v1.6.11...v1.6.12</a></li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/authlib/authlib/blob/1.6.12/docs/changelog.rst">authlib's changelog</a>.</em></p> <blockquote> <h2>Version 1.6.12</h2> <p><strong>Released on may 4, 2026</strong></p> <ul> <li>Fix redirecting to unvalidated <code>redirect_uri</code> on <code>InvalidScopeError</code> in <code>OpenIDImplicitGrant</code> and <code>OpenIDHybridGrant</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/authlib/authlib/commit/e46e515b3a87ea63ab0606b248d75f69d83a2391"><code>e46e515</code></a> chore: bump to 1.6.12</li> <li><a href="https://github.com/authlib/authlib/commit/9babc131e13b018a267ae78747cba7caa6dfb7d5"><code>9babc13</code></a> fix: redirecting to unvalidated redirect_uri on InvalidScopeError in OIDC grants</li> <li>See full diff in <a href="https://github.com/authlib/authlib/compare/v1.6.11...1.6.12">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
326ecbecd9 |
Python: Bump idna from 3.11 to 3.15 in /python (#14024)
Bumps [idna](https://github.com/kjd/idna) from 3.11 to 3.15. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/kjd/idna/blob/master/HISTORY.md">idna's changelog</a>.</em></p> <blockquote> <h2>3.15 (2026-05-12)</h2> <ul> <li>Enforce DNS-length cap on individual labels early in <code>check_label</code>, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.</li> <li>Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared <code>_unicode_dots_re</code> from <code>idna.core</code> in the codec module.</li> <li>Use <code>raise ... from err</code> for proper exception chaining and switch internal string formatting to f-strings.</li> <li>Allow <code>flit_core</code> 4.x in the build backend.</li> <li>Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.</li> <li>Add Dependabot configuration for GitHub Actions.</li> <li>Convert README and HISTORY from reStructuredText to Markdown.</li> <li>Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.</li> </ul> <p>Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.</p> <h2>3.14 (2026-05-10)</h2> <ul> <li>Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]</li> </ul> <p>Thanks to Stan Ulbrych for reporting the issue.</p> <h2>3.13 (2026-04-22)</h2> <ul> <li>Correct classification error for codepoint U+A7F1</li> </ul> <h2>3.12 (2026-04-21)</h2> <ul> <li>Update to Unicode 17.0.0.</li> <li>Issue a deprecation warning for the transitional argument.</li> <li>Added lazy-loading to provide some performance improvements.</li> <li>Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.</li> </ul> <p>Thanks to Rodrigo Nogueira for contributions to this release.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8"><code>af30a09</code></a> Release 3.15</li> <li><a href="https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2"><code>30314d4</code></a> Pre-release 3.15rc0</li> <li><a href="https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9"><code>05d4b21</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/237">#237</a> from kjd/convert-docs-to-markdown</li> <li><a href="https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee"><code>2987fdb</code></a> Convert README and HISTORY from reStructuredText to Markdown</li> <li><a href="https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c"><code>59fa800</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/236">#236</a> from kjd/dependabot/github_actions/actions-f3e34333ea</li> <li><a href="https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2"><code>def6983</code></a> Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea</li> <li><a href="https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631"><code>bbd8004</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/234">#234</a> from StanFromIreland/patch-1</li> <li><a href="https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc"><code>edd07c0</code></a> Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group</li> <li><a href="https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123"><code>5557db0</code></a> Merge branch 'master' into patch-1</li> <li><a href="https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d"><code>f11746c</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/235">#235</a> from StanFromIreland/patch-2</li> <li>Additional commits viewable in <a href="https://github.com/kjd/idna/compare/v3.11...v3.15">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
f6f47a298c |
Bump pyarrow from 21.0.0 to 23.0.1 in /python (#14058)
Bumps [pyarrow](https://github.com/apache/arrow) from 21.0.0 to 23.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/arrow/releases">pyarrow's releases</a>.</em></p> <blockquote> <h2>Apache Arrow 23.0.1</h2> <p>Release Notes URL: <a href="https://arrow.apache.org/release/23.0.1.html">https://arrow.apache.org/release/23.0.1.html</a></p> <h2>Apache Arrow 23.0.1 RC0</h2> <p>Release Notes: Release Candidate: 23.0.1 RC0</p> <h2>Apache Arrow 23.0.0</h2> <p>Release Notes URL: <a href="https://arrow.apache.org/release/23.0.0.html">https://arrow.apache.org/release/23.0.0.html</a></p> <h2>Apache Arrow 23.0.0 RC2</h2> <p>Release Notes: Release Candidate: 23.0.0 RC2</p> <h2>Apache Arrow 22.0.0</h2> <p>Release Notes URL: <a href="https://arrow.apache.org/release/22.0.0.html">https://arrow.apache.org/release/22.0.0.html</a></p> <h2>Apache Arrow 22.0.0 RC1</h2> <p>Release Notes: Release Candidate: 22.0.0 RC1</p> <h2>Apache Arrow 22.0.0 RC0</h2> <p>Release Notes: Release Candidate: 22.0.0 RC0</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/arrow/commit/82a374e5f3de5b744f26591e6cd96de6349c76d9"><code>82a374e</code></a> MINOR: [Release] Update versions for 23.0.1</li> <li><a href="https://github.com/apache/arrow/commit/c1ae37c4a597f466b1806e65a9e011be1060dfc5"><code>c1ae37c</code></a> MINOR: [Release] Update .deb/.rpm changelogs for 23.0.1</li> <li><a href="https://github.com/apache/arrow/commit/8f6e55736f60f1f95aee1e8765c6b75ad9589111"><code>8f6e557</code></a> MINOR: [Release] Update CHANGELOG.md for 23.0.1</li> <li><a href="https://github.com/apache/arrow/commit/4e16a1aeed83a65e6b49556c2fed8e9061cdf980"><code>4e16a1a</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49159">GH-49159</a>: [C++][Gandiva] Detect overflow in repeat() (<a href="https://redirect.github.com/apache/arrow/issues/49160">#49160</a>)</li> <li><a href="https://github.com/apache/arrow/commit/985621dbfcf3fd2061889e43c50b59825df84f3f"><code>985621d</code></a> <a href="https://redirect.github.com/apache/arrow/issues/48817">GH-48817</a> [R][C++] Bump C++20 in R build infrastructure (<a href="https://redirect.github.com/apache/arrow/issues/48819">#48819</a>)</li> <li><a href="https://github.com/apache/arrow/commit/1bea06ad4e14d75dd97a78a0148cd9cf6f4df0bc"><code>1bea06a</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49024">GH-49024</a>: [CI] Update Debian version in <code>.env</code> (<a href="https://redirect.github.com/apache/arrow/issues/49032">#49032</a>)</li> <li><a href="https://github.com/apache/arrow/commit/147bcd6d8f3fef05dd06968d3b60c17721c60334"><code>147bcd6</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49156">GH-49156</a>: [Python] Require GIL for string comparison (<a href="https://redirect.github.com/apache/arrow/issues/49161">#49161</a>)</li> <li><a href="https://github.com/apache/arrow/commit/e4f922b1621b6c833f583cf26500f115ab5bc483"><code>e4f922b</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49138">GH-49138</a>: [Packaging][Python] Remove nightly cython install from manylinux wh...</li> <li><a href="https://github.com/apache/arrow/commit/f9376e4721b81bad9fe3fe840926a3283f95ee30"><code>f9376e4</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49003">GH-49003</a>: [C++] Don't consider <code>out_of_range</code> an error in float parsing (<a href="https://redirect.github.com/apache/arrow/issues/49095">#49095</a>)</li> <li><a href="https://github.com/apache/arrow/commit/ab2c0ad6b23d05d5f77fc8a34d5a1c4baaacb0a4"><code>ab2c0ad</code></a> <a href="https://redirect.github.com/apache/arrow/issues/49044">GH-49044</a>: [CI][Python] Fix test_download_tzdata_on_windows by adding required...</li> <li>Additional commits viewable in <a href="https://github.com/apache/arrow/compare/apache-arrow-21.0.0...apache-arrow-23.0.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]andGitHub Copilot
|
03f73aee5e |
Python: Bump torch from 2.8.0 to 2.12.0 in /python (#14065)
Bumps [torch](https://github.com/pytorch/pytorch) from 2.8.0 to 2.12.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pytorch/pytorch/releases">torch's releases</a>.</em></p> <blockquote> <h1>PyTorch 2.12.0 Release Notes</h1> <ul> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#highlights">Highlights</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes">Backwards Incompatible Changes</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#deprecations">Deprecations</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#new-features">New Features</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#improvements">Improvements</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes">Bug fixes</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#performance">Performance</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#documentation">Documentation</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#developers">Developers</a></li> <li><a href="https://github.com/pytorch/pytorch/blob/HEAD/#security">Security</a></li> </ul> <h1>Highlights</h1> <!-- raw HTML omitted --> <p>For more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.</p> <h1>Backwards Incompatible Changes</h1> <h2>Build Frontend</h2> <ul> <li> <p>Strengthened SVE compile checks in <code>FindARM.cmake</code>, which may reject previously accepted but incorrect SVE configurations (<a href="https://redirect.github.com/pytorch/pytorch/pull/176646">#176646</a>)</p> <p>Source builds that enable SVE now validate the compiler configuration more strictly. If a build previously passed with an incomplete or mismatched SVE setup, it may now fail during CMake configuration instead of later in compilation. Update the compiler/toolchain flags so they accurately describe the target SVE support, or disable SVE for that build.</p> </li> <li> <p>Updated the minimum CUDA version required to build PyTorch from source to CUDA 12.6 (<a href="https://redirect.github.com/pytorch/pytorch/pull/178925">#178925</a>)</p> <p>Building PyTorch from source with CUDA versions older than 12.6 is no longer supported. Users building custom binaries should install CUDA 12.6 or newer and make sure <code>CUDA_HOME</code> points to that installation.</p> <p>Version 2.11:</p> <pre lang="bash"><code>CUDA_HOME=/usr/local/cuda-12.4 python setup.py develop </code></pre> <p>Version 2.12:</p> <pre lang="bash"><code>CUDA_HOME=/usr/local/cuda-12.6 python setup.py develop </code></pre> </li> <li> <p>Enforced a C++20 minimum in CMake build files (<a href="https://redirect.github.com/pytorch/pytorch/pull/178662">#178662</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pytorch/pytorch/commit/0d62256a2b23365f8e1604297eb23a6545102aa8"><code>0d62256</code></a> [release] Dockerfile: skip torchaudio install when CUDA_PATH=cu132 (<a href="https://redirect.github.com/pytorch/pytorch/issues/183346">#183346</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/7661cd9c6b841b62b7f411aa52ec51f05457263b"><code>7661cd9</code></a> [MPS] Fix SDPA wrong output for permuted q/k/v with B > 1 (<a href="https://redirect.github.com/pytorch/pytorch/issues/181886">#181886</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/9da6087ab64ab6a2118686420ca5353c90dd7e1f"><code>9da6087</code></a> Fix stale PYTORCH_RELEASES_CODE_CC dict (fixes <a href="https://redirect.github.com/pytorch/pytorch/issues/182250">#182250</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182369">#182369</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/e4c37cc011d47246ce8ea4b99c9b28fb7f400224"><code>e4c37cc</code></a> Avoid raw stream name collisions in Inductor (<a href="https://redirect.github.com/pytorch/pytorch/issues/182178">#182178</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/822d047dc8dd8d919f83c3ad5c786e405075d1f0"><code>822d047</code></a> [MPS] Fix bool mask handling in 1-pass SDPA decode kernel (<a href="https://redirect.github.com/pytorch/pytorch/issues/182285">#182285</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182311">#182311</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/5c5e523cd520e6986006e45be243b3ee927ea546"><code>5c5e523</code></a> Add enable_gqa parameter to SDPA MPS meta registration (<a href="https://redirect.github.com/pytorch/pytorch/issues/181550">#181550</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/eece52ead16886e5463c3dcee9b04db783cc68d5"><code>eece52e</code></a> [AOTI] Add BC-safe c_shim v2 for _scaled_dot_product_attention_math_for_mps e...</li> <li><a href="https://github.com/pytorch/pytorch/commit/b39330bbe210b9628207e84d8ba2cabb7975fbac"><code>b39330b</code></a> [Inductor] Call latest c_shim version for versioned fallback ops (<a href="https://redirect.github.com/pytorch/pytorch/issues/181548">#181548</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/06f10d088229a25ac52bd14b6cacc04a4161f6ca"><code>06f10d0</code></a> Revert "[FSDP2] add fqn to communication ops" (<a href="https://redirect.github.com/pytorch/pytorch/issues/182100">#182100</a>) (<a href="https://redirect.github.com/pytorch/pytorch/issues/182157">#182157</a>)</li> <li><a href="https://github.com/pytorch/pytorch/commit/449e3393139a1aca9afec120c9a63f98f12d55b0"><code>449e339</code></a> Revert "[Inductor] Improve materialization heuristic for a chain of computaio...</li> <li>Additional commits viewable in <a href="https://github.com/pytorch/pytorch/compare/v2.8.0...v2.12.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: GitHub Copilot <[email protected]> |
||
|
dependabot[bot]andcopilot-swe-agent[bot]
|
91efa2120c |
Python: Bump bleach from 6.3.0 to 6.4.0 in /python (#14089)
Bumps [bleach](https://github.com/mozilla/bleach) from 6.3.0 to 6.4.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/mozilla/bleach/blob/main/CHANGES">bleach's changelog</a>.</em></p> <blockquote> <h2>Version 6.4.0 (June 5th, 2026)</h2> <p><strong>NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues.</strong> See issue: <code><https://github.com/mozilla/bleach/issues/698></code>__</p> <p><strong>Backwards incompatible changes</strong></p> <ul> <li>Dropped support for pypy 3.10. (<a href="https://redirect.github.com/mozilla/bleach/issues/764">#764</a>)</li> </ul> <p><strong>Security fixes</strong></p> <ul> <li> <p>Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.</p> <p>Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.</p> <p>For example::</p> <p>import bleach payload1 = '<!-- raw HTML omitted -->Click<!-- raw HTML omitted -->' result1 = bleach.clean(payload1) print(repr(result1))</p> <p>outputs::</p> <p>'<!-- raw HTML omitted -->Click<!-- raw HTML omitted -->'</p> <p>See the advisory for details.</p> </li> <li> <p>Fix GHSA-gj48-438w-jh9v.</p> <p>Fix issue where URI sanitization wasn't happening in formaction attributes.</p> <p>See the advisory for details.</p> </li> </ul> <p><strong>Bug fixes</strong></p> <ul> <li> <p>Add support for pypy 3.11. (<a href="https://redirect.github.com/mozilla/bleach/issues/764">#764</a>)</p> </li> <li> <p>Drop version max in tinycss2 pin. (<a href="https://redirect.github.com/mozilla/bleach/issues/772">#772</a>)</p> <p>This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mozilla/bleach/commit/f0355a7af00500482c5292c6c83290c6a178068d"><code>f0355a7</code></a> fix: fix last release date in CHANGES</li> <li><a href="https://github.com/mozilla/bleach/commit/ae4e8a26706516ad01b92e66321b480208a440da"><code>ae4e8a2</code></a> chore: bleach 6.4.0 and final release</li> <li><a href="https://github.com/mozilla/bleach/commit/970df58e9f0c55cc52244f3f0106e473a40d886d"><code>970df58</code></a> fix: uri-sanitization in formaction attributes</li> <li><a href="https://github.com/mozilla/bleach/commit/7c4867c32344d1c961107fae62240a6f0dc680dc"><code>7c4867c</code></a> fix: xss bypass in allowed protocol test using unicode invisible characters</li> <li><a href="https://github.com/mozilla/bleach/commit/913ab75992b845e2c9c060c41f24d46921db4693"><code>913ab75</code></a> fix: reduce redundancy in workflow jobs</li> <li><a href="https://github.com/mozilla/bleach/commit/218c15af455c8dec14f98fcb2e235f8680e93930"><code>218c15a</code></a> fix: rework pip caching</li> <li><a href="https://github.com/mozilla/bleach/commit/4f0b097bf80548a022050e2f71f024d755a9f154"><code>4f0b097</code></a> fix: fix tox platform restrictions</li> <li><a href="https://github.com/mozilla/bleach/commit/e95a79d07bb5d792425c2bc0ef5dd03f6614f3bb"><code>e95a79d</code></a> chore: update pytest</li> <li><a href="https://github.com/mozilla/bleach/commit/91539d4e80d4685b8f2bedc79076ff0ff6c1b911"><code>91539d4</code></a> Bump actions/cache from 5.0.3 to 5.0.4</li> <li><a href="https://github.com/mozilla/bleach/commit/cd47b4ce495859065da23c2116f651e591e1e90d"><code>cd47b4c</code></a> fix: handle left-angle-bracket that's not a tag (<a href="https://redirect.github.com/mozilla/bleach/issues/733">#733</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mozilla/bleach/compare/v6.3.0...v6.4.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> |
||
|
|
13f812b825 |
Python: Update pymongo requirement from <4.16,>=4.8.0 to >=4.8.0,<4.17 in /python (#13866)
Updates the requirements on [pymongo](https://github.com/mongodb/mongo-python-driver) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mongodb/mongo-python-driver/releases">pymongo's releases</a>.</em></p> <blockquote> <h2>PyMongo 4.16.0</h2> <p>Community notes: <!-- raw HTML omitted --></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/mongodb/mongo-python-driver/blob/master/doc/changelog.rst">pymongo's changelog</a>.</em></p> <blockquote> <h2>Changes in Version 4.16.0 (2026/01/07)</h2> <p>PyMongo 4.16 brings a number of changes including:</p> <ul> <li>Removed invalid documents from :class:<code>bson.errors.InvalidDocument</code> error messages as doing so may leak sensitive user data. Instead, invalid documents are stored in :attr:<code>bson.errors.InvalidDocument.document</code>.</li> <li>PyMongo now requires <code>dnspython>=2.6.1</code>, since <code>dnspython</code> 1.0 is no longer maintained. The minimum version is <code>2.6.1</code> to account for <code>CVE-2023-29483 <https://www.cve.org/CVERecord?id=CVE-2023-29483></code>_.</li> <li>Removed support for Eventlet. Eventlet is actively being sunset by its maintainers and has compatibility issues with PyMongo's dnspython dependency.</li> <li>Use Zstandard support from the standard library for Python 3.14+, and use <code>backports.zstd</code> for older versions.</li> <li>Fixed return type annotation for <code>find_one_and_*</code> methods on :class:<code>~pymongo.asynchronous.collection.AsyncCollection</code> and :class:<code>~pymongo.synchronous.collection.Collection</code> to include <code>None</code>.</li> <li>Added support for NumPy 1D-arrays in :class:<code>bson.binary.BinaryVector</code>.</li> <li>Prevented :class:<code>~pymongo.encryption.ClientEncryption</code> from loading the crypt shared library to fix "MongoCryptError: An existing crypt_shared library is loaded by the application" unless the linked library search path is set.</li> </ul> <h2>Changes in Version 4.15.5 (2025/12/02)</h2> <p>Version 4.15.5 is a bug fix release.</p> <ul> <li>Fixed a bug that could cause <code>AutoReconnect("connection pool paused")</code> errors when cursors fetched more documents from the database after SDAM heartbeat failures.</li> </ul> <h2>Changes in Version 4.15.4 (2025/10/21)</h2> <p>Version 4.15.4 is a bug fix release.</p> <ul> <li>Relaxed the callback type of :meth:<code>~pymongo.asynchronous.client_session.AsyncClientSession.with_transaction</code> to allow the broader Awaitable type rather than only Coroutine objects.</li> <li>Added the missing Python 3.14 trove classifier to the package metadata.</li> </ul> <p>Issues Resolved ...............</p> <p>See the <code>PyMongo 4.15.4 release notes in JIRA</code>_ for the list of resolved issues in this release.</p> <p>.. _PyMongo 4.15.4 release notes in JIRA: <a href="https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=47237">https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=47237</a></p> <h2>Changes in Version 4.15.3 (2025/10/07)</h2> <p>Version 4.15.3 is a bug fix release.</p> <ul> <li>Fixed a memory leak when raising :class:<code>bson.errors.InvalidDocument</code> with C extensions.</li> <li>Fixed the return type of the :meth:<code>~pymongo.asynchronous.collection.AsyncCollection.distinct</code>,</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/32901018ca14d9acb05004a88d65b6ab0b29c877"><code>3290101</code></a> Prepare 4.16.0 release (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2672">#2672</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/1be94d262dd0281b032b6f9e56d381cac3a7a6d9"><code>1be94d2</code></a> PYTHON-5685 Fix unified spec sync metadata for csot and sessions tests (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2669">#2669</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/6585d9cb51d5c9b2d85eec4f49b8196612d9e8ee"><code>6585d9c</code></a> PYTHON-2442: Refactor: use _asdict() in _options_dict() (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2670">#2670</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/fdb1f7ea4abe128ae4e59e3d063fd95d7daaa964"><code>fdb1f7e</code></a> PYTHON-5677 Prevent ClientEncryption from loading crypt shared library (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2659">#2659</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/0cd9763423b85cd37779ea934bf7b1f8be8bbf8e"><code>0cd9763</code></a> Bump zizmorcore/zizmor-action from cb3d8e846e148d1111d90b03375b9c03deceda37 t...</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/2f263d4d3f11eb4a2b32ace467fd2767c371f4d7"><code>2f263d4</code></a> PYTHON-5680 Fix handling of expectedDocuments in Unified Test Runner (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2665">#2665</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/e9658b2406232b6bd6ac1d961b368142f8819479"><code>e9658b2</code></a> Add 4.15.5 release date to changelog (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2666">#2666</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/10dd20405ba19c643a1b305ff84f742b19c40daf"><code>10dd204</code></a> Update coverage[toml] requirement from <=7.10.6,>=5 to >=5,<=7.10.7 (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2662">#2662</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/130067799cc671d4dcc2f34dafff73c4ef5ddeaf"><code>1300677</code></a> [Spec Resync] 12-22-2025 (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2663">#2663</a>)</li> <li><a href="https://github.com/mongodb/mongo-python-driver/commit/18c1f142b5b3fd179a677b2736332dc17770b7c2"><code>18c1f14</code></a> PYTHON-5529 Introduce optin setting to await for MinPoolSize population (<a href="https://redirect.github.com/mongodb/mongo-python-driver/issues/2664">#2664</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mongodb/mongo-python-driver/compare/4.8.0...4.16.0">compare view</a></li> </ul> </details> <br /> You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: moonbox3 <[email protected]> |
||
|
dependabot[bot]andcopilot-swe-agent[bot]
|
356aed0986 |
Python: Bump starlette from 0.52.1 to 1.3.1 in /python (#14092)
Bumps [starlette](https://github.com/Kludex/starlette) from 0.52.1 to 1.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p> <blockquote> <h2>Version 1.3.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>StarletteDeprecationWarning</code> instead of <code>DeprecationWarning</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3119">Kludex/starlette#3119</a></li> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3329">Kludex/starlette#3329</a></li> <li>Enforce <code>FormParser</code> limits in parser callbacks by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3331">Kludex/starlette#3331</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.3.0...1.3.1">https://github.com/Kludex/starlette/compare/1.3.0...1.3.1</a></p> <h2>Version 1.3.0</h2> <h2>What's Changed</h2> <ul> <li>Clamp oversized suffix ranges in <code>FileResponse</code> by <a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files by <a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li>Add <code>httpx2</code> to the <code>full</code> extra by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3323">Kludex/starlette#3323</a></li> <li>Adjust testclient typing and warnings by <a href="https://github.com/waketzheng"><code>@waketzheng</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3322">Kludex/starlette#3322</a></li> <li>Fix IndexError in URL.replace() on a URL with no authority by <a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li>Annotate URLPath protocol parameter with Literal by <a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li>avoid collapsing exception groups from user code by <a href="https://github.com/graingert"><code>@graingert</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/2830">Kludex/starlette#2830</a></li> <li>Use <code>removeprefix</code> to strip weak ETag indicator in <code>is_not_modified</code> by <a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> <li>Build <code>request.url</code> from structured components by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3326">Kludex/starlette#3326</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li><a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li><a href="https://github.com/leestana01"><code>@leestana01</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3319">Kludex/starlette#3319</a></li> <li><a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li><a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3204">Kludex/starlette#3204</a></li> <li><a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li><a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.1...1.3.0">https://github.com/Kludex/starlette/compare/1.2.1...1.3.0</a></p> <h2>Version 1.2.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module by <a href="https://github.com/leifwar"><code>@leifwar</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li>Add assert error for requires() when request param is not Request type by <a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/leifwar"><code>@leifwar</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li><a href="https://github.com/diskeu"><code>@diskeu</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3243">Kludex/starlette#3243</a></li> <li><a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.0...1.2.1">https://github.com/Kludex/starlette/compare/1.2.0...1.2.1</a></p> <h2>Version 1.2.0</h2> <h2>What's Changed</h2> <ul> <li>Support httpx2 in the test client by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3291">Kludex/starlette#3291</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.1.0...1.2.0">https://github.com/Kludex/starlette/compare/1.1.0...1.2.0</a></p> <h2>Version 1.1.0</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p> <blockquote> <h2>1.3.1 (June 12, 2026)</h2> <h4>Fixed</h4> <ul> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> <a href="https://redirect.github.com/encode/starlette/pull/3329">#3329</a>.</li> <li>Enforce <code>FormParser</code> limits in parser callbacks <a href="https://redirect.github.com/encode/starlette/pull/3331">#3331</a>.</li> </ul> <h2>1.3.0 (June 11, 2026)</h2> <h4>Added</h4> <ul> <li>Add <code>httpx2</code> to the <code>full</code> extra <a href="https://redirect.github.com/encode/starlette/pull/3323">#3323</a>.</li> <li>Annotate the <code>URLPath</code> <code>protocol</code> parameter with <code>Literal</code> <a href="https://redirect.github.com/encode/starlette/pull/3285">#3285</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Build <code>request.url</code> from structured components <a href="https://redirect.github.com/encode/starlette/pull/3326">#3326</a>.</li> <li>Clamp oversized suffix ranges in <code>FileResponse</code> <a href="https://redirect.github.com/encode/starlette/pull/3307">#3307</a>.</li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files <a href="https://redirect.github.com/encode/starlette/pull/3191">#3191</a>.</li> <li>Avoid collapsing exception groups raised from user code <a href="https://redirect.github.com/encode/starlette/pull/2830">#2830</a>.</li> <li>Use <code>removeprefix</code> to strip the weak <code>ETag</code> indicator in <code>is_not_modified</code> <a href="https://redirect.github.com/encode/starlette/pull/3193">#3193</a>.</li> <li>Fix <code>IndexError</code> in <code>URL.replace()</code> on a URL with no authority <a href="https://redirect.github.com/encode/starlette/pull/3317">#3317</a>.</li> <li>Adjust <code>testclient</code> typing and warnings <a href="https://redirect.github.com/encode/starlette/pull/3322">#3322</a>.</li> </ul> <h2>1.2.1 (May 31, 2026)</h2> <h4>Fixed</h4> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module <a href="https://redirect.github.com/encode/starlette/pull/3304">#3304</a>.</li> <li>Add assert error for <code>requires()</code> when the request parameter is not a <code>Request</code> type <a href="https://redirect.github.com/encode/starlette/pull/3298">#3298</a>.</li> </ul> <h2>1.2.0 (May 28, 2026)</h2> <h4>Added</h4> <ul> <li>Support httpx2 in the test client <a href="https://redirect.github.com/encode/starlette/pull/3291">#3291</a>.</li> </ul> <h2>1.1.0 (May 23, 2026)</h2> <h4>Added</h4> <ul> <li>Use <code>"application/octet-stream"</code> as the <code>FileResponse</code> media type fallback <a href="https://redirect.github.com/encode/starlette/pull/3283">#3283</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Only dispatch standard HTTP verbs in <code>HTTPEndpoint</code> <a href="https://redirect.github.com/encode/starlette/pull/3286">#3286</a>.</li> <li>Reject absolute paths in <code>StaticFiles.lookup_path</code> <a href="https://redirect.github.com/encode/starlette/pull/3287">#3287</a>.</li> </ul> <h2>1.0.1 (May 21, 2026)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Kludex/starlette/commit/8ebffd0678570ddd5d5bb11c6f3c3c7fd4682ab9"><code>8ebffd0</code></a> Version 1.3.1 (<a href="https://redirect.github.com/Kludex/starlette/issues/3330">#3330</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/25b8e179d8d7ed86769c02f648772dd5fb43dc3c"><code>25b8e17</code></a> Enforce <code>FormParser</code> limits in parser callbacks (<a href="https://redirect.github.com/Kludex/starlette/issues/3331">#3331</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/dba1c4babc4f99ad2622bb913d87045775dda735"><code>dba1c4b</code></a> Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3329">#3329</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/45e51dcf99f3a270b0bcec1aec5410b4345863a9"><code>45e51dc</code></a> Use <code>StarletteDeprecationWarning</code> instead of <code>DeprecationWarning</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3119">#3119</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/5f8610c386e13de1d80d36efa961e1486a1d2d01"><code>5f8610c</code></a> Version 1.3.0 (<a href="https://redirect.github.com/Kludex/starlette/issues/3327">#3327</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/167b5850e809f38b27fbfed62d58bf6442855975"><code>167b585</code></a> Build <code>request.url</code> from structured components (<a href="https://redirect.github.com/Kludex/starlette/issues/3326">#3326</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/37309255b4c1b9c381a2d24a1eaf83100984a16a"><code>3730925</code></a> Use <code>removeprefix</code> to strip weak ETag indicator in <code>is_not_modified</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3193">#3193</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/e6f7ad1ab85efb27ab7910d8007b3f4531f7b083"><code>e6f7ad1</code></a> avoid collapsing exception groups from user code (<a href="https://redirect.github.com/Kludex/starlette/issues/2830">#2830</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/115228fcdca0e0ef5bf4a95a40ddce5a9fced428"><code>115228f</code></a> Annotate URLPath protocol parameter with Literal (<a href="https://redirect.github.com/Kludex/starlette/issues/3285">#3285</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/113f193a34353c9153857028c1074351d22fad07"><code>113f193</code></a> docs: replace inline ASGI server list with link to canonical implemen… (<a href="https://redirect.github.com/Kludex/starlette/issues/3204">#3204</a>)</li> <li>Additional commits viewable in <a href="https://github.com/Kludex/starlette/compare/0.52.1...1.3.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> |
||
|
dependabot[bot]
|
51748eecf3 |
Python: Bump pyjwt from 2.11.0 to 2.13.0 in /python (#14084)
Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.11.0 to 2.13.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.13.0</h2> <h1>PyJWT 2.13.0 — Security Release</h1> <p>This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.</p> <h2>Security</h2> <ul> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"><code>GHSA-xgmm-8j9v-c9wx</code></a> — JWK JSON accepted as HMAC secret (algorithm confusion).</strong> <code>HMACAlgorithm.prepare_key</code> previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in <code>algorithms=[…]</code> and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. <em>Reported by <a href="https://github.com/aradona91"><code>@aradona91</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f"><code>GHSA-jq35-7prp-9v3f</code></a> — Algorithm allow-list bypass with <code>PyJWK</code> / <code>PyJWKClient</code>.</strong> When verifying with a <code>PyJWK</code>, the caller's <code>algorithms=[…]</code> allow-list was checked against the token header <code>alg</code> as a string only; actual verification used the algorithm bound to the <code>PyJWK</code>. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header <code>alg</code> to match the <code>PyJWK</code>'s algorithm before verification. <em>Reported by <a href="https://github.com/sushi-gif"><code>@sushi-gif</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39"><code>GHSA-w7vc-732c-9m39</code></a> — DoS via base64 decode of unused payload segment when <code>b64=false</code>.</strong> For detached-payload JWS (<code>b64=false</code>), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied <code>detached_payload</code>. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. <em>Reported by <a href="https://github.com/thesmartshadow"><code>@thesmartshadow</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4"><code>GHSA-993g-76c3-p5m4</code></a> — <code>PyJWKClient</code> accepts non-HTTP(S) URIs.</strong> <code>PyJWKClient.fetch_data</code> passed its URI to <code>urllib.request.urlopen</code>, which by default also handles <code>file://</code>, <code>ftp://</code>, and <code>data:</code> schemes. An application that fed an attacker-influenced URI into <code>PyJWKClient</code> could be coerced into reading local files or reaching other unintended schemes. <code>PyJWKClient</code> now rejects any URI whose scheme isn't <code>http</code> or <code>https</code>. <em>Reported by <a href="https://github.com/KEIJOT"><code>@KEIJOT</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8"><code>GHSA-fhv5-28vv-h8m8</code></a> — <code>PyJWKClient</code> cache wiped on fetch error.</strong> A <code>finally</code>-block <code>put(jwk_set=None)</code> cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. <em>Reported by <a href="https://github.com/eddieran"><code>@eddieran</code></a>.</em></p> </li> </ul> <h2>Fixed</h2> <ul> <li>Reject empty HMAC keys outright in <code>HMACAlgorithm.prepare_key</code> with <code>InvalidKeyError</code> instead of accepting them with only a warning. Defends against the <code>os.getenv("JWT_SECRET", "")</code> footgun. <em>Thanks to <a href="https://github.com/SnailSploit"><code>@SnailSploit</code></a> and <a href="https://github.com/spartan8806"><code>@spartan8806</code></a> for the reports.</em></li> <li>Forward per-call <code>options</code> (including <code>enforce_minimum_key_length</code>) from <code>PyJWT.decode</code> through to <code>PyJWS._verify_signature</code>. The option was previously silently dropped between the two layers, so it only took effect when set on the <code>PyJWT</code> instance. <em>Thanks to <a href="https://github.com/WLUB"><code>@WLUB</code></a> for the report.</em></li> <li><strong>RFC 7797 §3 compliance for <code>b64=false</code>:</strong> the encoder now auto-adds <code>"b64"</code> to <code>crit</code>, and the decoder rejects tokens that set <code>b64=false</code> without listing it in <code>crit</code>. <em>Thanks to <a href="https://github.com/MachineLearning-Nerd"><code>@MachineLearning-Nerd</code></a> for the report.</em></li> </ul> <h2>Changed</h2> <ul> <li>Migrate the <code>dev</code>, <code>docs</code>, and <code>tests</code> package extras to dependency groups, by <a href="https://github.com/kurtmckee"><code>@kurtmckee</code></a> in <a href="https://redirect.github.com/jpadilla/pyjwt/pull/1152">#1152</a>.</li> </ul> <h2>Upgrade notes</h2> <p>Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:</p> <ul> <li><strong>Empty HMAC keys now raise.</strong> If your app passed <code>""</code> or <code>b""</code> as a secret (often via a missing env var, e.g. <code>os.getenv("JWT_SECRET", "")</code>), <code>encode</code>/<code>decode</code> will now raise <code>InvalidKeyError</code>. This is the intended behavior — fix the configuration.</li> <li><strong><code>PyJWK</code> decoding now requires the token's <code>alg</code> to match the JWK's algorithm.</strong> Previously a mismatch was silently honored if the header <code>alg</code> appeared in the allow-list. Tokens that relied on this mismatch will now fail with <code>InvalidAlgorithmError</code>.</li> <li><strong><code>PyJWKClient</code> now rejects non-HTTP(S) URIs at construction time.</strong> Tests or dev environments that fetched JWKS from <code>file://</code> URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct <code>PyJWKSet.from_dict(...)</code> directly).</li> <li><strong><code>b64=false</code> tokens are now strictly RFC 7515 / 7797 compliant.</strong> Tokens with a non-empty compact-form payload segment, or that omit <code>"b64"</code> from <code>crit</code>, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.</li> <li><strong><code>enforce_minimum_key_length</code> set per-call now takes effect.</strong> Callers who passed <code>options={"enforce_minimum_key_length": True}</code> to <code>jwt.decode()</code> previously got no enforcement; they will now get <code>InvalidKeyError</code> on undersized keys, as documented.</li> </ul> <p><strong>Full changelog:</strong> <a href="https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0">https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0</a></p> <h2>2.12.1</h2> <h2>What's Changed</h2> <ul> <li>Add typing_extensions dependency for Python < 3.11 by <a href="https://github.com/jpadilla"><code>@jpadilla</code></a> in <a href="https://redirect.github.com/jpadilla/pyjwt/pull/1151">jpadilla/pyjwt#1151</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1">https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1</a></p> <h2>2.12.0</h2> <h2>Security</h2> <ul> <li>Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by <a href="https://github.com/dmbs335"><code>@dmbs335</code></a> in <a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f">GHSA-752w-5fwx-jx9f</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0></code>__</h2> <p>Security</p> <pre><code> - Reject JWK JSON documents passed as raw HMAC secrets in ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that the existing PEM/SSH guard did not cover. Reported by @aradona91 in `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__. - Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during verification so the caller's ``algorithms=[...]`` allow-list cannot be bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__. - Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker- influenced URIs cannot read local files or reach unintended schemes via urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__. - Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``. The previous ``finally``-block ``put(None)`` pattern cleared the cache on any transient outage, turning one bad JWKS request into application- wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__. - Skip the unconditional base64 decode of the compact-form payload segment when ``b64=false`` is set in the protected header, and require that segment to be empty (RFC 7515 Appendix F detached form). Closes an unauthenticated DoS amplifier. Reported by @thesmartshadow in `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__. <p>Fixed</p> <pre><code> - Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with ``InvalidKeyError`` instead of accepting them with only a warning. Thanks to @SnailSploit and @spartan8806 for independently flagging the footgun. - Forward per-call ``options`` (including ``enforce_minimum_key_length``) from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the option actually takes effect when set at the call site rather than only on the ``PyJWT`` instance. Thanks to @WLUB for the report. - RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds ``&quot;b64&quot;`` to the ``crit`` header parameter, and the decoder rejects tokens that set ``b64=false`` without listing it in ``crit``. Thanks to @MachineLearning-Nerd for the report. Changed </code></pre> <ul> <li>Migrate the <code>dev</code>, <code>docs</code>, and <code>tests</code> package extras to dependency groups by <a href="https://github.com/kurtmckee"><code>@kurtmckee</code></a> in <code>[#1152](https://github.com/jpadilla/pyjwt/issues/1152) &lt;https://github.com/jpadilla/pyjwt/pull/1152&gt;</code>__</li> </ul> <p><code>v2.12.1 &lt;https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1&gt;</code>__ </tr></table> </code></pre></p> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jpadilla/pyjwt/commit/7144e4534c34810f4525dc4578a32addd8212cff"><code>7144e45</code></a> Apply ruff format</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/d2f4bec4963897c0ef96ef64a875894f2c8542ab"><code>d2f4bec</code></a> Restore <code>cast()</code> calls with cross-version <code>type: ignore</code> for <code>prepare_key</code></li> <li><a href="https://github.com/jpadilla/pyjwt/commit/22f478cebddd8294259c30f037ecb92b0b348774"><code>22f478c</code></a> Remove redundant casts in <code>RSAAlgorithm.prepare_key</code> and `ECAlgorithm.prepare...</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81"><code>95791b1</code></a> Bundle security fixes and hardening into 2.13.0</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/dcc27a9d3182a2349c30b160758785c6ce7a6508"><code>dcc27a9</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1155">#1155</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/9d08a9a1896845ed8eaf88e6f6ac61e5800c3e7a"><code>9d08a9a</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1146">#1146</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/b87c10014d4109f0214fea188d00faaaf8a80e64"><code>b87c100</code></a> Bump codecov/codecov-action from 5 to 6 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1154">#1154</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/40e3147eb5f790d8d041772e5fc00728a176c812"><code>40e3147</code></a> Migrate development extras to dependency groups (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1152">#1152</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/a4e1a3d1218b01c5806420b8f16d9308ac4adc30"><code>a4e1a3d</code></a> Add typing_extensions dependency for Python < 3.11 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1151">#1151</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/bd9700cca7f9258fadcc429c1034e508025931f2"><code>bd9700c</code></a> Use PyJWK algorithm when encoding without explicit algorithm (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1148">#1148</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.11.0...2.13.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]andcopilot-swe-agent[bot]
|
614db62500 |
Python: Bump tornado from 6.5.5 to 6.5.7 in /python (#14090)
Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.7. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst">tornado's changelog</a>.</em></p> <blockquote> <h1>Release notes</h1> <p>.. toctree:: :maxdepth: 2</p> <p>releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2 releases/v3.2.1</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4"><code>48fc2d4</code></a> Merge pull request <a href="https://redirect.github.com/tornadoweb/tornado/issues/3633">#3633</a> from bdarnell/curl-reset-65</li> <li><a href="https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841"><code>4ae1ddd</code></a> Release notes and version bump for 6.5.7</li> <li><a href="https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43"><code>3154caa</code></a> curl_httpclient: Reset the curl object before putting it on the freelist</li> <li><a href="https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2"><code>7d869c0</code></a> Merge pull request <a href="https://redirect.github.com/tornadoweb/tornado/issues/3631">#3631</a> from bdarnell/cve-links</li> <li><a href="https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3"><code>288241f</code></a> docs: Use the correct link syntax</li> <li><a href="https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6"><code>8da981c</code></a> docs: Add CVE links to 6.5.6 release notes</li> <li><a href="https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751"><code>aba2569</code></a> Merge pull request <a href="https://redirect.github.com/tornadoweb/tornado/issues/3626">#3626</a> from bdarnell/fixes-656</li> <li><a href="https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09"><code>a24b260</code></a> httpclient_test: Accept an additional error message variant</li> <li><a href="https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24"><code>a74240a</code></a> Release notes and version bump for 6.5.6.</li> <li><a href="https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5"><code>e8fc7ed</code></a> simple_httpclient: Strip auth headers on cross-origin redirects</li> <li>Additional commits viewable in <a href="https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> |
||
|
Evan Mattson
|
cd1b0205fa |
Python: Bump Python version to 1.43.1 for a release. (#14093)
### Motivation and Context Bump Python version to 1.43.1 for a release. <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Bump Python version to 1.43.1 for a release. <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [X] I didn't break anyone 😄 |
||
|
Roger Barreto
|
6ba60965bd |
Python: Reject encoded dot-segment paths in OpenAPI plugin (.NET and Python) (#14086)
## Motivation and Context Closes #14085. The .NET and Python OpenAPI plugins select operations using the raw OpenAPI path, but build the runtime request URL from a canonicalized path. Encoded dot-segments such as `/resources/%2e%2e/admin` pass an `OperationSelectionPredicate` path check, yet `System.Uri` (.NET) and `urljoin` (Python) collapse them to a different route at request time. The selected path and the actual request target can therefore diverge. ## Description - **.NET** (`RestApiOperation.ValidatePathSegments`): decodes each path segment until stable (handling double encoding like `%252e` and encoded separators `%2f`/`%5c`) before rejecting canonical `.` or `..` segments. - **Python** (`RestApiOperation.build_path`): adds equivalent decode-then-reject validation before the URL is built. Regression tests on both stacks cover literal and encoded dot-segments, mixed case, encoded slashes, and double encoding, plus negative tests confirming legitimate encoded characters still work. Test results: - .NET: 482/482 `Functions.UnitTests` OpenApi tests pass. - Python: 109/109 `openapi_plugin` unit tests pass. ## Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the SK Contribution Guidelines - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 |
||
|
SergeyMenshykhandCopilot
|
61331d834d |
Python: Add function_choice_behavior support to Azure AI and OpenAI Assistant agents (#14057)
### Description Adds `function_choice_behavior` parameter to Azure AI and OpenAI Assistant agents, aligning them with the existing Responses agent and Chat Completion agent APIs. ### Changes - Add `function_choice_behavior` parameter to `invoke`/`invoke_stream`/`get_response` on both `AzureAIAgent` and `OpenAIAssistantAgent` public APIs - Add `function_choice_behavior` parameter to internal `AzureAIAgentThreadActions` and `AssistantThreadActions` `invoke`/`invoke_stream` methods - Support `tools` parameter override for SDK-level tools (CodeInterpreter, FileSearch, etc.) - Filter kernel functions based on `FunctionChoiceBehavior` configuration - Validate that only `Auto` type with auto-invoke enabled is supported - Fix `_get_tools` in OpenAI path to use passed `kernel` parameter instead of `agent.kernel` - Add comprehensive unit tests for both thread actions and public agent APIs --------- Co-authored-by: Copilot <[email protected]> |
||
|
Evan Mattson
|
417d62f8b1 |
Python: Bump Python package version to 1.43.0 for a release (#14052)
### Motivation and Context Bump Python package version to 1.43.0 for a release <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Bump Python package version to 1.43.0 for a release <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
SergeyMenshykhandCopilot
|
644eb0a962 |
Python: [Breaking] Update OpenAPI document parsing options (#14009)
Update OpenAPI document parsing to gate file and HTTP ref resolution separately. ### Breaking change - `RESOLVE_FILES` is no longer enabled by default. Only internal JSON pointer references are resolved by default. - Users with multi-file OpenAPI specs must now pass `enable_file_ref_resolution=True` via `OpenAPIFunctionExecutionParameters`. - `enable_external_ref_resolution` has been renamed to `enable_http_ref_resolution`. --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
58f4a66858 |
Python: Improve function call invocation parameter consistency (#14014)
## Description This PR improves the consistency of how the function_behavior parameter is passed through internal invoke_function_call callsites. ### Changes - Thread function_behavior parameter through all internal invoke_function_call callsites for consistent parameter handling: - Realtime connector (_open_ai_realtime.py) - Responses agent (responses_agent_thread_actions.py) - Assistant agent (assistant_thread_actions.py) - Azure AI agent (agent_thread_actions.py) - Bedrock agent (bedrock_agent.py) - Add defensive logging in kernel.py when function_behavior is not provided - Add unit tests covering parameter handling scenarios ### Testing - All existing tests pass (678 passed, 0 failed) - 5 new tests added covering the updated parameter handling Co-authored-by: Copilot <[email protected]> |
||
|
Evan Mattson
|
2fb749e4bb |
Python: Bump Python pkg version to 1.42.0 for a release. (#14007)
### Motivation and Context Bump Python pkg version to 1.42.0 for a release. <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Bump Python pkg version to 1.42.0 for a release. <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [X] I didn't break anyone 😄 |
||
|
Evan MattsonandCopilot
|
a6c68af594 |
Python: Improvements for MCP (#14003)
### Motivation and Context Improvements for MCP tool calls by adding an optional sampling callback. <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Improvements for MCP tool calls by adding an optional sampling callback. <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
32abf99e29 |
Python: Harden HttpPlugin request validation (#13969)
Improve input validation and request handling in the Python HttpPlugin. ### Changes - Add explicit opt-in for unrestricted domain access - Tighten URL validation logic - Improve redirect handling when domain restrictions are configured - Add regression tests --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
a7cea9ab64 |
Python: Stop accessing private Azure SDK attributes in Azure AI Search connector (#13971)
### Motivation and Context CI fails with `AttributeError: 'SearchIndexClient' object has no attribute '_endpoint'` when `azure-search-documents` resolves to 12.0.0 (released 2026-04-01). The 12.0.0 release migrated from AutoRest to TypeSpec code generation, removing private attributes `_endpoint` and `_credential` from `SearchIndexClient`. CI uses `uv sync -U` which upgrades past the lockfile, pulling in 12.0.0 since `pyproject.toml` specifies `>= 11.6.0b4` with no upper bound. ### Description Stop reading `SearchIndexClient._endpoint` and `._credential`. Instead, store endpoint and credential as explicit fields on `AzureAISearchStore` and `AzureAISearchCollection`, and pass them directly when constructing `SearchClient`. **Changes:** - `_get_search_client()` accepts explicit `endpoint` + `credential` params instead of extracting from `SearchIndexClient` private attrs - `_resolve_credential()` new helper extracted from `_get_search_index_client()` for reuse - `AzureAISearchStore` / `AzureAISearchCollection` store `search_endpoint` and `search_credential` as fields, thread them through construction - Tests updated to assert on public fields instead of private SDK attributes ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] All unit tests pass with both `azure-search-documents==11.7.0b2` and `==12.0.0` - [x] No breaking changes to public API --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
3f0e2d58fa |
Python: Percent-encode OpenAPI path params & pin azure-search-documents (#13967)
Apply `urllib.parse.quote(safe='')` to path parameter values before substitution in `build_path()`, consistent with the .NET implementation which uses `HttpUtility.UrlEncode`. ### Changes - `rest_api_operation.py`: encode path parameter values per RFC 3986 - `test_sk_openapi.py`: add tests for encoded path parameters - `pyproject.toml` / `uv.lock`: pin `azure-search-documents >= 11.6.0b4, < 12.0.0` ### Pin azure-search-documents < 12.0.0 Version 12.0.0 removed the internal `_endpoint` attribute from `SearchIndexClient`, which breaks `AzureAISearchCollection` initialization at `azure_ai_search.py:158`. Pinning to `< 12.0.0` until the code is updated to use the new public API. ### Tests All existing and new `build_path` tests pass. --------- Co-authored-by: Copilot <[email protected]> |
||
|
dependabot[bot]
|
4e4b9456b8 |
Python: Update pydantic requirement from !=2.10.0,!=2.10.1,!=2.10.2,!=2.10.3,<2.13,>=2.0 to >=2.0,!=2.10.0,!=2.10.1,!=2.10.2,!=2.10.3,<2.14 in /python (#13864)
Updates the requirements on [pydantic](https://github.com/pydantic/pydantic) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic/releases">pydantic's releases</a>.</em></p> <blockquote> <h2>v2.13.0 2026-04-13</h2> <h2>v2.13.0 (2026-04-13)</h2> <p>The highlights of the v2.13 release are available in the <a href="https://pydantic.dev/articles/pydantic-v2-13-release">blog post</a>. Several minor changes (considered non-breaking changes according to our <a href="https://pydantic.dev/docs/validation/2.13/get-started/version-policy/#pydantic-v2">versioning policy</a>) are also included in this release. Make sure to look into them before upgrading.</p> <p>This release contains the updated <code>pydantic.v1</code> namespace, matching version 1.10.26 which includes support for Python 3.14.</p> <h3>What's Changed</h3> <p>See the beta releases for all changes sinces 2.12.</p> <h4>Packaging</h4> <ul> <li>Add zizmor for GitHub Actions workflow linting by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13039">#13039</a></li> <li>Update jiter to v0.14.0 to fix a segmentation fault on musl Linux by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13064">#13064</a></li> </ul> <h4>New Features</h4> <ul> <li>Allow default factories of private attributes to take validated model data by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13013">#13013</a></li> </ul> <h4>Changes</h4> <ul> <li>Warn when serializing fixed length tuples with too few items by <a href="https://github.com/arvindsaripalli"><code>@arvindsaripalli</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13016">#13016</a></li> </ul> <h4>Fixes</h4> <ul> <li>Change type of <code>Any</code> when synthesizing <code>_build_sources</code> for <code>BaseSettings.__init__()</code> signature in the mypy plugin by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13049">#13049</a></li> <li>Fix model equality when using runtime <code>extra</code> configuration by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13062">#13062</a></li> </ul> <h3>New Contributors</h3> <ul> <li><a href="https://github.com/arvindsaripalli"><code>@arvindsaripalli</code></a> made their first contribution in <a href="https://redirect.github.com/pydantic/pydantic/pull/13016">#13016</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/pydantic/compare/v2.12.0...v2.13.0">https://github.com/pydantic/pydantic/compare/v2.12.0...v2.13.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic/blob/main/HISTORY.md">pydantic's changelog</a>.</em></p> <blockquote> <h2>v2.13.0 (2026-04-13)</h2> <p><a href="https://github.com/pydantic/pydantic/releases/tag/v2.13.0">GitHub release</a></p> <p>The highlights of the v2.13 release are available in the <a href="https://pydantic.dev/articles/pydantic-v2-13-release">blog post</a>. Several minor changes (considered non-breaking changes according to our <a href="https://pydantic.dev/docs/validation/2.13/get-started/version-policy/#pydantic-v2">versioning policy</a>) are also included in this release. Make sure to look into them before upgrading.</p> <p>This release contains the updated <code>pydantic.v1</code> namespace, matching version 1.10.26 which includes support for Python 3.14.</p> <h3>What's Changed</h3> <p>See the beta releases for all changes sinces 2.12.</p> <h4>New Features</h4> <ul> <li>Allow default factories of private attributes to take validated model data by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13013">#13013</a></li> </ul> <h4>Changes</h4> <ul> <li>Warn when serializing fixed length tuples with too few items by <a href="https://github.com/arvindsaripalli"><code>@arvindsaripalli</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13016">#13016</a></li> </ul> <h4>Fixes</h4> <ul> <li>Change type of <code>Any</code> when synthesizing <code>_build_sources</code> for <code>BaseSettings.__init__()</code> signature in the mypy plugin by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13049">#13049</a></li> <li>Fix model equality when using runtime <code>extra</code> configuration by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13062">#13062</a></li> </ul> <h4>Packaging</h4> <ul> <li>Add zizmor for GitHub Actions workflow linting by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13039">#13039</a></li> <li>Update jiter to v0.14.0 to fix a segmentation fault on musl Linux by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13064">#13064</a></li> </ul> <h3>New Contributors</h3> <ul> <li><a href="https://github.com/arvindsaripalli"><code>@arvindsaripalli</code></a> made their first contribution in <a href="https://redirect.github.com/pydantic/pydantic/pull/13016">#13016</a></li> </ul> <h2>v2.13.0b3 (2026-03-31)</h2> <p><a href="https://github.com/pydantic/pydantic/releases/tag/v2.13.0b3">GitHub release</a></p> <h3>What's Changed</h3> <h4>New Features</h4> <ul> <li>Add <code>ascii_only</code> option to <code>StringConstraints</code> by <a href="https://github.com/ai-man-codes"><code>@ai-man-codes</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12907">#12907</a></li> <li>Support <code>exclude_if</code> in computed fields by <a href="https://github.com/andresliszt"><code>@andresliszt</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12748">#12748</a></li> <li>Push down constraints in unions involving <code>MISSING</code> sentinel by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/12908">#12908</a></li> </ul> <h4>Changes</h4> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pydantic/pydantic/commit/46bf4fa648af3a1fbf4603a37f210e9d9c618357"><code>46bf4fa</code></a> Fix Pydantic release workflow (<a href="https://redirect.github.com/pydantic/pydantic/issues/13067">#13067</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/1b359edab09c623464d23c6fd2503ae5ff276d43"><code>1b359ed</code></a> Prepare release v2.13.0 (<a href="https://redirect.github.com/pydantic/pydantic/issues/13065">#13065</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/b1bf19445d8ac144a7a0e82674d2d87eebab6c18"><code>b1bf194</code></a> Fix model equality when using runtime <code>extra</code> configuration (<a href="https://redirect.github.com/pydantic/pydantic/issues/13062">#13062</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/17a35e371bdff348c0690651d324c91fc7c9ff9e"><code>17a35e3</code></a> Update jiter to v0.14.0 (<a href="https://redirect.github.com/pydantic/pydantic/issues/13064">#13064</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/feea402b23fa23774669908c4e08a61ba1e4238e"><code>feea402</code></a> Use <code>simulation</code> mode in Codspeed CI (<a href="https://redirect.github.com/pydantic/pydantic/issues/13063">#13063</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/671c9b0d4d3f9b2f1b95ca32ac85cb69e824e0bc"><code>671c9b0</code></a> Add basic benchmarks for model equality (<a href="https://redirect.github.com/pydantic/pydantic/issues/13061">#13061</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/d17d71e00a35f190b27321aa6f8f2a03139c00b8"><code>d17d71e</code></a> Bump cryptography from 46.0.6 to 46.0.7 (<a href="https://redirect.github.com/pydantic/pydantic/issues/13056">#13056</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/919d61ac419af5151b673a90b65c9a12631091cf"><code>919d61a</code></a> 👥 Update Pydantic People (<a href="https://redirect.github.com/pydantic/pydantic/issues/13059">#13059</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/e7cf5dcb939ea98511e669b647c0273667a1b08a"><code>e7cf5dc</code></a> Fix people workflow (<a href="https://redirect.github.com/pydantic/pydantic/issues/13047">#13047</a>)</li> <li><a href="https://github.com/pydantic/pydantic/commit/2a806ad09b984fcc43568191aba5d965350995a0"><code>2a806ad</code></a> Add regression test for <code>MISSING</code> sentinel serialization with subclasses (<a href="https://redirect.github.com/pydantic/pydantic/issues/13">#13</a>...</li> <li>Additional commits viewable in <a href="https://github.com/pydantic/pydantic/compare/v2.0...v2.13.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
6cc918e87f |
Update google-genai requirement from ~=1.51.0 to >=1.51,<1.75 in /python (#13865)
Updates the requirements on [google-genai](https://github.com/googleapis/python-genai) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/python-genai/releases">google-genai's releases</a>.</em></p> <blockquote> <h2>v1.74.0</h2> <h2><a href="https://github.com/googleapis/python-genai/compare/v1.73.1...v1.74.0">1.74.0</a> (2026-04-29)</h2> <h3>Features</h3> <ul> <li>[Interactions] Add FileCitation.{custom_metadata,media_id,page_number} (<a href="https://github.com/googleapis/python-genai/commit/aed41ecf4940f63446fc3e22744663be4d1057a6">aed41ec</a>)</li> <li>Add <code>output_info</code> to <code>BatchJob</code> (<a href="https://github.com/googleapis/python-genai/commit/7b77ab850283a2c55cb711084e8de6b6da5e589c">7b77ab8</a>)</li> <li>Add gemini-3.1-flash-tts-preview model to options (<a href="https://github.com/googleapis/python-genai/commit/8bdc1c353d987a5a18282fd2265950257891d308">8bdc1c3</a>)</li> <li>Add ImageResizeMode for GenerateVideos (<a href="https://github.com/googleapis/python-genai/commit/317d2af040adc7639c4464971d2a5ffa5e381402">317d2af</a>)</li> <li>Add new Gemini Deep Research agent models (<a href="https://github.com/googleapis/python-genai/commit/16fffbd3504e9c83c605410dc75914bf3bcaeedb">16fffbd</a>)</li> <li>Add one_of support to JSONSchema for Agent Platform (<a href="https://github.com/googleapis/python-genai/commit/8c00c524488250f25f497e47b495dcedb362da86">8c00c52</a>)</li> <li>Add Vertex Dataset input and output options for batch jobs (<a href="https://github.com/googleapis/python-genai/commit/d880f92a0631868d6cf86e30aa219a18305ad1a0">d880f92</a>)</li> <li><strong>interaction-api:</strong> Add grounding tool usage breakdown to Interaction Usage. (<a href="https://github.com/googleapis/python-genai/commit/b24fb5a1758499e3979cdcadfa734bfa7dd72c94">b24fb5a</a>)</li> <li>Introduce <code>enterprise</code> to Client constructor and <code>GOOGLE_GENAI_USE_ENTERPRISE</code> (<a href="https://github.com/googleapis/python-genai/commit/693fd9af1054fde006f76ea820b0c9066577b243">693fd9a</a>)</li> <li>Replace the more ambiguous rate field with sample_rate. (<a href="https://github.com/googleapis/python-genai/commit/88d9b4ad772ce75f21d44174f4679e994fcfca48">88d9b4a</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Catch google-auth wrapped errors (<a href="https://github.com/googleapis/python-genai/commit/48ac850fa06de2288e4d736f2f7349909c2a0727">48ac850</a>)</li> <li>Removing Python 3.9 support due to EOL (<a href="https://github.com/googleapis/python-genai/commit/8bc2b1028da7b94ed0baa31f89a1bf007aaa0bf8">8bc2b10</a>)</li> <li><strong>retry:</strong> Retry on httpx.TimeoutException with HttpRetryOptions (<a href="https://redirect.github.com/googleapis/python-genai/issues/2345">#2345</a>) (<a href="https://github.com/googleapis/python-genai/commit/0598bab551f40d852dcd4b4575be8dacec42f83e">0598bab</a>)</li> <li>Streaming method doesn't handle multi-line SSE (<a href="https://github.com/googleapis/python-genai/commit/f8a2e7ea8c39800aa0a6c50585de49c2c0d5f247">f8a2e7e</a>)</li> <li>Typing in <code>AsyncClient.__aexit__</code>, <code>__exit__</code>. (<a href="https://github.com/googleapis/python-genai/commit/a74dc6564e3409f9c45a1ec8456ed4386c3711c0">a74dc65</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Add instruction for custom endpoint (<a href="https://github.com/googleapis/python-genai/commit/dd79904ed3a51fb53c43d4b01082556baf579759">dd79904</a>)</li> <li>Fix broken link for rate limits (<a href="https://github.com/googleapis/python-genai/commit/d22ea99dd4318c3bd47bfd6cb571bf9db3316922">d22ea99</a>)</li> <li>Regenerate docs for 1.73.1 (<a href="https://github.com/googleapis/python-genai/commit/2fb714b3fefa3a8972da57ef0675116b67e4808e">2fb714b</a>)</li> <li>Remove duplicate line in genai client docstring. (<a href="https://github.com/googleapis/python-genai/commit/b1c6026033fc753d1fcd474d8f63f254a876741c">b1c6026</a>)</li> <li>Replace Vertex AI with Gemini Enterprise Agent Platform (<a href="https://github.com/googleapis/python-genai/commit/7c1ecd586032a0546268ede3f115b2d25032ce12">7c1ecd5</a>)</li> <li>Update doc string to replace <code>Vertex AI</code> with <code>Gemini Enterprise Agent Platform</code>, update method error message to replace <code>Vertex AI</code> with <code>Gemini Enterprise Agent Platform (previously known as Vertex AI)</code>, update converter error message to replace <code>Vertex AI</code> with <code>Gemini Enterprise Agent Platform</code> (<a href="https://github.com/googleapis/python-genai/commit/413f0f9f1b5ff8bab9fd3675e9c450a4ddd29755">413f0f9</a>)</li> <li>Update Gemini Enterprise Agent Platform home page url (<a href="https://github.com/googleapis/python-genai/commit/b02cb95459375300c4e2acdef11a8ff0e8d5def6">b02cb95</a>)</li> <li>Update README.md with correct Pydantic link (<a href="https://github.com/googleapis/python-genai/commit/fa97cc6cf5bc955c1ff81da4e780fe0211648959">fa97cc6</a>)</li> <li>Update README.md with correct Pydantic link (<a href="https://github.com/googleapis/python-genai/commit/fa97cc6cf5bc955c1ff81da4e780fe0211648959">fa97cc6</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/python-genai/blob/main/CHANGELOG.md">google-genai's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/python-genai/compare/v1.73.1...v1.74.0">1.74.0</a> (2026-04-29)</h2> <h3>Features</h3> <ul> <li>[Interactions] Add FileCitation.{custom_metadata,media_id,page_number} (<a href="https://github.com/googleapis/python-genai/commit/aed41ecf4940f63446fc3e22744663be4d1057a6">aed41ec</a>)</li> <li>Add <code>output_info</code> to <code>BatchJob</code> (<a href="https://github.com/googleapis/python-genai/commit/7b77ab850283a2c55cb711084e8de6b6da5e589c">7b77ab8</a>)</li> <li>Add gemini-3.1-flash-tts-preview model to options (<a href="https://github.com/googleapis/python-genai/commit/8bdc1c353d987a5a18282fd2265950257891d308">8bdc1c3</a>)</li> <li>Add ImageResizeMode for GenerateVideos (<a href="https://github.com/googleapis/python-genai/commit/317d2af040adc7639c4464971d2a5ffa5e381402">317d2af</a>)</li> <li>Add new Gemini Deep Research agent models (<a href="https://github.com/googleapis/python-genai/commit/16fffbd3504e9c83c605410dc75914bf3bcaeedb">16fffbd</a>)</li> <li>Add one_of support to JSONSchema for Agent Platform (<a href="https://github.com/googleapis/python-genai/commit/8c00c524488250f25f497e47b495dcedb362da86">8c00c52</a>)</li> <li>Add Vertex Dataset input and output options for batch jobs (<a href="https://github.com/googleapis/python-genai/commit/d880f92a0631868d6cf86e30aa219a18305ad1a0">d880f92</a>)</li> <li><strong>interaction-api:</strong> Add grounding tool usage breakdown to Interaction Usage. (<a href="https://github.com/googleapis/python-genai/commit/b24fb5a1758499e3979cdcadfa734bfa7dd72c94">b24fb5a</a>)</li> <li>Introduce <code>enterprise</code> to Client constructor and <code>GOOGLE_GENAI_USE_ENTERPRISE</code> (<a href="https://github.com/googleapis/python-genai/commit/693fd9af1054fde006f76ea820b0c9066577b243">693fd9a</a>)</li> <li>Replace the more ambiguous rate field with sample_rate. (<a href="https://github.com/googleapis/python-genai/commit/88d9b4ad772ce75f21d44174f4679e994fcfca48">88d9b4a</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Catch google-auth wrapped errors (<a href="https://github.com/googleapis/python-genai/commit/48ac850fa06de2288e4d736f2f7349909c2a0727">48ac850</a>)</li> <li>Removing Python 3.9 support due to EOL (<a href="https://github.com/googleapis/python-genai/commit/8bc2b1028da7b94ed0baa31f89a1bf007aaa0bf8">8bc2b10</a>)</li> <li><strong>retry:</strong> Retry on httpx.TimeoutException with HttpRetryOptions (<a href="https://redirect.github.com/googleapis/python-genai/issues/2345">#2345</a>) (<a href="https://github.com/googleapis/python-genai/commit/0598bab551f40d852dcd4b4575be8dacec42f83e">0598bab</a>)</li> <li>Streaming method doesn't handle multi-line SSE (<a href="https://github.com/googleapis/python-genai/commit/f8a2e7ea8c39800aa0a6c50585de49c2c0d5f247">f8a2e7e</a>)</li> <li>Typing in <code>AsyncClient.__aexit__</code>, <code>__exit__</code>. (<a href="https://github.com/googleapis/python-genai/commit/a74dc6564e3409f9c45a1ec8456ed4386c3711c0">a74dc65</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Add instruction for custom endpoint (<a href="https://github.com/googleapis/python-genai/commit/dd79904ed3a51fb53c43d4b01082556baf579759">dd79904</a>)</li> <li>Fix broken link for rate limits (<a href="https://github.com/googleapis/python-genai/commit/d22ea99dd4318c3bd47bfd6cb571bf9db3316922">d22ea99</a>)</li> <li>Regenerate docs for 1.73.1 (<a href="https://github.com/googleapis/python-genai/commit/2fb714b3fefa3a8972da57ef0675116b67e4808e">2fb714b</a>)</li> <li>Remove duplicate line in genai client docstring. (<a href="https://github.com/googleapis/python-genai/commit/b1c6026033fc753d1fcd474d8f63f254a876741c">b1c6026</a>)</li> <li>Replace Vertex AI with Gemini Enterprise Agent Platform (<a href="https://github.com/googleapis/python-genai/commit/7c1ecd586032a0546268ede3f115b2d25032ce12">7c1ecd5</a>)</li> <li>Update doc string to replace <code>Vertex AI</code> with <code>Gemini Enterprise Agent Platform</code>, update method error message to replace <code>Vertex AI</code> with <code>Gemini Enterprise Agent Platform (previously known as Vertex AI)</code>, update converter error message to replace <code>Vertex AI</code> with <code>Gemini Enterprise Agent Platform</code> (<a href="https://github.com/googleapis/python-genai/commit/413f0f9f1b5ff8bab9fd3675e9c450a4ddd29755">413f0f9</a>)</li> <li>Update Gemini Enterprise Agent Platform home page url (<a href="https://github.com/googleapis/python-genai/commit/b02cb95459375300c4e2acdef11a8ff0e8d5def6">b02cb95</a>)</li> <li>Update README.md with correct Pydantic link (<a href="https://github.com/googleapis/python-genai/commit/fa97cc6cf5bc955c1ff81da4e780fe0211648959">fa97cc6</a>)</li> <li>Update README.md with correct Pydantic link (<a href="https://github.com/googleapis/python-genai/commit/fa97cc6cf5bc955c1ff81da4e780fe0211648959">fa97cc6</a>)</li> </ul> <h2><a href="https://github.com/googleapis/python-genai/compare/v1.73.0...v1.73.1">1.73.1</a> (2026-04-14)</h2> <h3>Bug Fixes</h3> <ul> <li>Refactor Webhook types in GenAI SDKs for easier useage (<a href="https://github.com/googleapis/python-genai/commit/3f36ca11b30904c8f82dd3e7e3b59eff3bde6a3b">3f36ca1</a>)</li> <li>Rename <code>webhooks.retrieve</code> to <code>webhooks.get</code>. (<a href="https://github.com/googleapis/python-genai/commit/649f4b06d7bd78a23dd77b06713c6ca5c65321f9">649f4b0</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Update python docs for 1.73.0 (<a href="https://github.com/googleapis/python-genai/commit/acd3767bff513524172ddd7726b147d01c245f1c">acd3767</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/python-genai/commit/860c041810c6b37638ea23370d39c80364b5c99a"><code>860c041</code></a> chore(main): release 1.74.0 (<a href="https://redirect.github.com/googleapis/python-genai/issues/2285">#2285</a>)</li> <li><a href="https://github.com/googleapis/python-genai/commit/abcaa0d25da63a58c9ef96dac3b692c8396e5f42"><code>abcaa0d</code></a> chore: Fix usage examples of LocalTokenizer.</li> <li><a href="https://github.com/googleapis/python-genai/commit/b7e877129ee75e1fe824e2dc97e951a5ba5690cb"><code>b7e8771</code></a> chore: Add page number</li> <li><a href="https://github.com/googleapis/python-genai/commit/841301ee3901b34899a583939dfc28462d3db9d9"><code>841301e</code></a> chore: Adjust Webhook update to better reflect modifiable fields</li> <li><a href="https://github.com/googleapis/python-genai/commit/b24fb5a1758499e3979cdcadfa734bfa7dd72c94"><code>b24fb5a</code></a> feat(interaction-api): Add grounding tool usage breakdown to Interaction Usage.</li> <li><a href="https://github.com/googleapis/python-genai/commit/b1c6026033fc753d1fcd474d8f63f254a876741c"><code>b1c6026</code></a> docs: Remove duplicate line in genai client docstring.</li> <li><a href="https://github.com/googleapis/python-genai/commit/0598bab551f40d852dcd4b4575be8dacec42f83e"><code>0598bab</code></a> fix(retry): retry on httpx.TimeoutException with HttpRetryOptions (<a href="https://redirect.github.com/googleapis/python-genai/issues/2345">#2345</a>)</li> <li><a href="https://github.com/googleapis/python-genai/commit/f8a2e7ea8c39800aa0a6c50585de49c2c0d5f247"><code>f8a2e7e</code></a> fix: Streaming method doesn't handle multi-line SSE</li> <li><a href="https://github.com/googleapis/python-genai/commit/8bc2b1028da7b94ed0baa31f89a1bf007aaa0bf8"><code>8bc2b10</code></a> fix: Removing Python 3.9 support due to EOL</li> <li><a href="https://github.com/googleapis/python-genai/commit/ab5e3283bed8a3c1502c9486f68848a1d5e821a0"><code>ab5e328</code></a> chore: internal change</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/python-genai/compare/v1.51.0...v1.74.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
479f9443ee |
Python: Bump google-cloud-aiplatform from 1.114.0 to 1.133.0 in /python (#13577)
Bumps [google-cloud-aiplatform](https://github.com/googleapis/python-aiplatform) from 1.114.0 to 1.133.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/python-aiplatform/releases">google-cloud-aiplatform's releases</a>.</em></p> <blockquote> <h2>v1.133.0</h2> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.132.0...v1.133.0">1.133.0</a> (2026-01-08)</h2> <h3>Features</h3> <ul> <li>Deprecate tuning public preview SDK in favor of tuning SDK (<a href="https://github.com/googleapis/python-aiplatform/commit/35d362ce8f6c50498f781857e0d8cabd327284be">35d362c</a>)</li> <li>GenAI SDK client - Enabling Few-shot Prompt Optimization by passing either "OPTIMIZATION_TARGET_FEW_SHOT_RUBRICS" or "OPTIMIZATION_TARGET_FEW_SHOT_TARGET_RESPONSE" to the <code>optimize_prompt</code> method (<a href="https://github.com/googleapis/python-aiplatform/commit/715cc5b71b996eecde2d97bad71a617274739dcc">715cc5b</a>)</li> <li>GenAI SDK client(memory): Add enable_third_person_memories (<a href="https://github.com/googleapis/python-aiplatform/commit/65717fa0c3d9b8c3105638cf9c75ee415f36b6e0">65717fa</a>)</li> <li>Support Developer Connect in AE (<a href="https://github.com/googleapis/python-aiplatform/commit/04f1771e16f54a0627ecac1266764ca77f833694">04f1771</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Add None check for agent_info in evals.py (<a href="https://github.com/googleapis/python-aiplatform/commit/c8c0f0f7eb67696c2e91902af7e6dca20cea2040">c8c0f0f</a>)</li> <li>GenAI client(evals) - Fix TypeError in _build_generate_content_config (<a href="https://github.com/googleapis/python-aiplatform/commit/be2eaaa30dbf13a86f6856771eeacd2a51a97806">be2eaaa</a>)</li> <li>Make project_number to project_id mapping fail-open. (<a href="https://github.com/googleapis/python-aiplatform/commit/f1c8458dd5e4641cb03ff175f0837b6d6017c131">f1c8458</a>)</li> <li>Replace asyncio.run with create_task in ADK async thread mains. (<a href="https://github.com/googleapis/python-aiplatform/commit/83f4076706d808dcc0e1784219856846540e10da">83f4076</a>)</li> <li>Replace asyncio.run with create_task in ADK async thread mains. (<a href="https://github.com/googleapis/python-aiplatform/commit/8c876ef069d0fe6942790ede41e203196cd4a390">8c876ef</a>)</li> <li>Require uri or staging bucket configuration for saving model to Vertex Experiment. (<a href="https://github.com/googleapis/python-aiplatform/commit/5448f065fa30d77c2ee0868249ec0bea6a93a4c0">5448f06</a>)</li> <li>Return embedding metadata if available (<a href="https://github.com/googleapis/python-aiplatform/commit/d9c6eb199b6ccc1fae417463e1b374574f2ae2f8">d9c6eb1</a>)</li> <li>Update <code>examples_dataframe</code> type to <code>PandasDataFrame</code> in Prompt Optimizer. (<a href="https://github.com/googleapis/python-aiplatform/commit/a2564cc3ea5c4860ee732f14cea9db2c10b52420">a2564cc</a>)</li> </ul> <h2>v1.132.0</h2> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.131.0...v1.132.0">1.132.0</a> (2025-12-17)</h2> <h3>Features</h3> <ul> <li>Add Lustre support to the Vertex Training Custom Job API (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>A comment for field <code>restart_job_on_worker_restart</code> in message <code>.google.cloud.aiplatform.v1beta1.Scheduling</code> is changed (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> <li>A comment for field <code>timeout</code> in message <code>.google.cloud.aiplatform.v1beta1.Scheduling</code> is changed (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> </ul> <h2>v1.131.0</h2> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.130.0...v1.131.0">1.131.0</a> (2025-12-16)</h2> <h3>Features</h3> <ul> <li>Allow list of events to be passed to AdkApp.async_stream_query (<a href="https://github.com/googleapis/python-aiplatform/commit/dd8840a5012b2762f8b8971b6cea4302ac5c648d">dd8840a</a>)</li> <li>GenAI Client(evals) - Support CustomCodeExecution metric in Vertex Gen AI Eval Service (<a href="https://github.com/googleapis/python-aiplatform/commit/4114728750b5b12f991a18df87c1f1a570d1b29d">4114728</a>)</li> <li>Updates the ADK template to direct structured JSON logs to standard output. (<a href="https://github.com/googleapis/python-aiplatform/commit/a65ec297c5b8d99e4d2dfb49473c189197198f97">a65ec29</a>)</li> </ul> <h3>Bug Fixes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/python-aiplatform/blob/main/CHANGELOG.md">google-cloud-aiplatform's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.132.0...v1.133.0">1.133.0</a> (2026-01-08)</h2> <h3>Features</h3> <ul> <li>Deprecate tuning public preview SDK in favor of tuning SDK (<a href="https://github.com/googleapis/python-aiplatform/commit/35d362ce8f6c50498f781857e0d8cabd327284be">35d362c</a>)</li> <li>GenAI SDK client - Enabling Few-shot Prompt Optimization by passing either "OPTIMIZATION_TARGET_FEW_SHOT_RUBRICS" or "OPTIMIZATION_TARGET_FEW_SHOT_TARGET_RESPONSE" to the <code>optimize_prompt</code> method (<a href="https://github.com/googleapis/python-aiplatform/commit/715cc5b71b996eecde2d97bad71a617274739dcc">715cc5b</a>)</li> <li>GenAI SDK client(memory): Add enable_third_person_memories (<a href="https://github.com/googleapis/python-aiplatform/commit/65717fa0c3d9b8c3105638cf9c75ee415f36b6e0">65717fa</a>)</li> <li>Support Developer Connect in AE (<a href="https://github.com/googleapis/python-aiplatform/commit/04f1771e16f54a0627ecac1266764ca77f833694">04f1771</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Add None check for agent_info in evals.py (<a href="https://github.com/googleapis/python-aiplatform/commit/c8c0f0f7eb67696c2e91902af7e6dca20cea2040">c8c0f0f</a>)</li> <li>GenAI client(evals) - Fix TypeError in _build_generate_content_config (<a href="https://github.com/googleapis/python-aiplatform/commit/be2eaaa30dbf13a86f6856771eeacd2a51a97806">be2eaaa</a>)</li> <li>Make project_number to project_id mapping fail-open. (<a href="https://github.com/googleapis/python-aiplatform/commit/f1c8458dd5e4641cb03ff175f0837b6d6017c131">f1c8458</a>)</li> <li>Replace asyncio.run with create_task in ADK async thread mains. (<a href="https://github.com/googleapis/python-aiplatform/commit/83f4076706d808dcc0e1784219856846540e10da">83f4076</a>)</li> <li>Replace asyncio.run with create_task in ADK async thread mains. (<a href="https://github.com/googleapis/python-aiplatform/commit/8c876ef069d0fe6942790ede41e203196cd4a390">8c876ef</a>)</li> <li>Require uri or staging bucket configuration for saving model to Vertex Experiment. (<a href="https://github.com/googleapis/python-aiplatform/commit/5448f065fa30d77c2ee0868249ec0bea6a93a4c0">5448f06</a>)</li> <li>Return embedding metadata if available (<a href="https://github.com/googleapis/python-aiplatform/commit/d9c6eb199b6ccc1fae417463e1b374574f2ae2f8">d9c6eb1</a>)</li> <li>Update <code>examples_dataframe</code> type to <code>PandasDataFrame</code> in Prompt Optimizer. (<a href="https://github.com/googleapis/python-aiplatform/commit/a2564cc3ea5c4860ee732f14cea9db2c10b52420">a2564cc</a>)</li> </ul> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.131.0...v1.132.0">1.132.0</a> (2025-12-17)</h2> <h3>Features</h3> <ul> <li>Add Lustre support to the Vertex Training Custom Job API (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> <li>Add Lustre support to the Vertex Training Custom Job API (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>A comment for field <code>restart_job_on_worker_restart</code> in message <code>.google.cloud.aiplatform.v1beta1.Scheduling</code> is changed (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> <li>A comment for field <code>timeout</code> in message <code>.google.cloud.aiplatform.v1beta1.Scheduling</code> is changed (<a href="https://github.com/googleapis/python-aiplatform/commit/71747e8cbb028f321fd9499bd77656b083909eb0">71747e8</a>)</li> </ul> <h2><a href="https://github.com/googleapis/python-aiplatform/compare/v1.130.0...v1.131.0">1.131.0</a> (2025-12-16)</h2> <h3>Features</h3> <ul> <li>Allow list of events to be passed to AdkApp.async_stream_query (<a href="https://github.com/googleapis/python-aiplatform/commit/dd8840a5012b2762f8b8971b6cea4302ac5c648d">dd8840a</a>)</li> <li>GenAI Client(evals) - Support CustomCodeExecution metric in Vertex Gen AI Eval Service (<a href="https://github.com/googleapis/python-aiplatform/commit/4114728750b5b12f991a18df87c1f1a570d1b29d">4114728</a>)</li> <li>Updates the ADK template to direct structured JSON logs to standard output. (<a href="https://github.com/googleapis/python-aiplatform/commit/a65ec297c5b8d99e4d2dfb49473c189197198f97">a65ec29</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Fix RagManagedVertexVectorSearch when using backend_config (<a href="https://github.com/googleapis/python-aiplatform/commit/df0976ed3195dc8313f4728bc5ecb29dda55d467">df0976e</a>)</li> <li>GenAI Client(evals) - patch for vulnerability in visualization (<a href="https://github.com/googleapis/python-aiplatform/commit/8a00d43dbd24e95dbab6ea32c63ce0a5a1849480">8a00d43</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/python-aiplatform/commit/78f2bdd08bae0696923e61ab73080b5846c67ae0"><code>78f2bdd</code></a> chore(main): release 1.133.0 (<a href="https://redirect.github.com/googleapis/python-aiplatform/issues/6211">#6211</a>)</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/c8c0f0f7eb67696c2e91902af7e6dca20cea2040"><code>c8c0f0f</code></a> fix: Add None check for agent_info in evals.py</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/9952b970b73cfe38e68c48b3699ee4e1df0264df"><code>9952b97</code></a> chore: rollback</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/83f4076706d808dcc0e1784219856846540e10da"><code>83f4076</code></a> fix: Replace asyncio.run with create_task in ADK async thread mains.</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/937d5af6b9bdbbe3b50181745c99550f124ad8b4"><code>937d5af</code></a> Copybara import of the project:</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/aaaf902be02747cd2281196aad6278df0fd11f7e"><code>aaaf902</code></a> chore: bump google-auth lower bound to 2.47.0 in GenAI and Vertex SDKs</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/8c876ef069d0fe6942790ede41e203196cd4a390"><code>8c876ef</code></a> fix: Replace asyncio.run with create_task in ADK async thread mains.</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/5448f065fa30d77c2ee0868249ec0bea6a93a4c0"><code>5448f06</code></a> fix: Require uri or staging bucket configuration for saving model to Vertex E...</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/65717fa0c3d9b8c3105638cf9c75ee415f36b6e0"><code>65717fa</code></a> feat: GenAI SDK client(memory): Add enable_third_person_memories</li> <li><a href="https://github.com/googleapis/python-aiplatform/commit/be2eaaa30dbf13a86f6856771eeacd2a51a97806"><code>be2eaaa</code></a> fix: GenAI client(evals) - Fix TypeError in _build_generate_content_config</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/python-aiplatform/compare/v1.114.0...v1.133.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
ff3a1c6c6e |
Python: Update boto3 requirement from <1.41.0,>=1.36.4 to >=1.36.4,<1.43.0 in /python (#13867)
Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/boto/boto3/commit/54a9dc1891d5e38110e5f77fc45fbc7e2e112bfe"><code>54a9dc1</code></a> Merge branch 'release-1.42.89'</li> <li><a href="https://github.com/boto/boto3/commit/730d84cd5a2396ff9bfe8b59b7ee7339aa6bd8c5"><code>730d84c</code></a> Bumping version to 1.42.89</li> <li><a href="https://github.com/boto/boto3/commit/6b657684e661904d387c867ccd8aea796f7092ff"><code>6b65768</code></a> Add changelog entries from botocore</li> <li><a href="https://github.com/boto/boto3/commit/f92a06cca537b03c6cbc71b2ab004674298053dd"><code>f92a06c</code></a> Merge branch 'release-1.42.88'</li> <li><a href="https://github.com/boto/boto3/commit/5da0f6a8b8ed0117747b2f8a4f2ffa2a8e3a5eb6"><code>5da0f6a</code></a> Merge branch 'release-1.42.88' into develop</li> <li><a href="https://github.com/boto/boto3/commit/9bdec29dd7a50a0412772bae77580bb3be674295"><code>9bdec29</code></a> Bumping version to 1.42.88</li> <li><a href="https://github.com/boto/boto3/commit/d880788fea57399dd5e9e2be08691a2b9ec26502"><code>d880788</code></a> Add changelog entries from botocore</li> <li><a href="https://github.com/boto/boto3/commit/39a412231d29b10761a1812efbbf00aa8d17d6a6"><code>39a4122</code></a> chore: add additional text to CONTRIBUTING.rst (<a href="https://redirect.github.com/boto/boto3/issues/4749">#4749</a>)</li> <li><a href="https://github.com/boto/boto3/commit/8d65320e4df23b56f3dc5b09ad75d95bcc85382b"><code>8d65320</code></a> Merge branch 'release-1.42.87'</li> <li><a href="https://github.com/boto/boto3/commit/fdcbb88dfbc65c8ef6fd3557f7d37c73ec6a09a2"><code>fdcbb88</code></a> Merge branch 'release-1.42.87' into develop</li> <li>Additional commits viewable in <a href="https://github.com/boto/boto3/compare/1.36.4...1.42.89">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
293ec8f850 |
Python: Bump python-multipart from 0.0.22 to 0.0.26 in /python (#13878)
Bumps [python-multipart](https://github.com/Kludex/python-multipart) from 0.0.22 to 0.0.26. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/python-multipart/releases">python-multipart's releases</a>.</em></p> <blockquote> <h2>Version 0.0.26</h2> <h2>What's Changed</h2> <ul> <li>Skip preamble before first multipart boundary by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/262">Kludex/python-multipart#262</a></li> <li>Silently discard epilogue data after the closing boundary by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/259">Kludex/python-multipart#259</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.25...0.0.26">https://github.com/Kludex/python-multipart/compare/0.0.25...0.0.26</a></p> <h2>Version 0.0.25</h2> <h2>What's Changed</h2> <ul> <li>Apply Apache-2.0 properly by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/247">Kludex/python-multipart#247</a></li> <li>Handle multipart headers case-insensitively by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/252">Kludex/python-multipart#252</a></li> <li>Emit <code>field_end</code> for trailing bare field names on finalize by <a href="https://github.com/bysiber"><code>@bysiber</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/230">Kludex/python-multipart#230</a></li> <li>Add <code>UPLOAD_DELETE_TMP</code> to <code>FormParser</code> config by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/254">Kludex/python-multipart#254</a></li> <li>Remove custom FormParser classes by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/257">Kludex/python-multipart#257</a></li> <li>Handle CTE values case-insensitively by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/258">Kludex/python-multipart#258</a></li> <li>Add MIME content type info to File by <a href="https://github.com/jhnstrk"><code>@jhnstrk</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/143">Kludex/python-multipart#143</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.24...0.0.25">https://github.com/Kludex/python-multipart/compare/0.0.24...0.0.25</a></p> <h2>Version 0.0.24</h2> <h2>What's Changed</h2> <ul> <li>Validate <code>chunk_size</code> in <code>parse_form()</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/244">Kludex/python-multipart#244</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.23...0.0.24">https://github.com/Kludex/python-multipart/compare/0.0.23...0.0.24</a></p> <h2>Version 0.0.23</h2> <h2>What's Changed</h2> <ul> <li>Remove unused <code>trust_x_headers</code> parameter and <code>X-File-Name</code> fallback by <a href="https://github.com/jhnstrk"><code>@jhnstrk</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/196">Kludex/python-multipart#196</a></li> <li>Return processed length from <code>QuerystringParser._internal_write</code> by <a href="https://github.com/bysiber"><code>@bysiber</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/229">Kludex/python-multipart#229</a></li> <li>Cleanup metadata dunders from <code>__init__.py</code> by <a href="https://github.com/Chesars"><code>@Chesars</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/227">Kludex/python-multipart#227</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Chesars"><code>@Chesars</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/python-multipart/pull/227">Kludex/python-multipart#227</a></li> <li><a href="https://github.com/bysiber"><code>@bysiber</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/python-multipart/pull/229">Kludex/python-multipart#229</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.22...0.0.23">https://github.com/Kludex/python-multipart/compare/0.0.22...0.0.23</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md">python-multipart's changelog</a>.</em></p> <blockquote> <h2>0.0.26 (2026-04-10)</h2> <ul> <li>Skip preamble before the first multipart boundary more efficiently <a href="https://redirect.github.com/Kludex/python-multipart/pull/262">#262</a>.</li> <li>Silently discard epilogue data after the closing multipart boundary <a href="https://redirect.github.com/Kludex/python-multipart/pull/259">#259</a>.</li> </ul> <h2>0.0.25 (2026-04-10)</h2> <ul> <li>Add MIME content type info to <code>File</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/143">#143</a>.</li> <li>Handle CTE values case-insensitively <a href="https://redirect.github.com/Kludex/python-multipart/pull/258">#258</a>.</li> <li>Remove custom <code>FormParser</code> classes <a href="https://redirect.github.com/Kludex/python-multipart/pull/257">#257</a>.</li> <li>Add <code>UPLOAD_DELETE_TMP</code> to <code>FormParser</code> config <a href="https://redirect.github.com/Kludex/python-multipart/pull/254">#254</a>.</li> <li>Emit <code>field_end</code> for trailing bare field names on finalize <a href="https://redirect.github.com/Kludex/python-multipart/pull/230">#230</a>.</li> <li>Handle multipart headers case-insensitively <a href="https://redirect.github.com/Kludex/python-multipart/pull/252">#252</a>.</li> <li>Apply Apache-2.0 properly <a href="https://redirect.github.com/Kludex/python-multipart/pull/247">#247</a>.</li> </ul> <h2>0.0.24 (2026-04-05)</h2> <ul> <li>Validate <code>chunk_size</code> in <code>parse_form()</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/244">#244</a>.</li> </ul> <h2>0.0.23 (2026-04-05)</h2> <ul> <li>Remove unused <code>trust_x_headers</code> parameter and <code>X-File-Name</code> fallback <a href="https://redirect.github.com/Kludex/python-multipart/pull/196">#196</a>.</li> <li>Return processed length from <code>QuerystringParser._internal_write</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/229">#229</a>.</li> <li>Cleanup metadata dunders from <code>__init__.py</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/227">#227</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Kludex/python-multipart/commit/28f47859b4a40c2e11e02dc514b2e9743ceedd2e"><code>28f4785</code></a> Version 0.0.26 (<a href="https://redirect.github.com/Kludex/python-multipart/issues/263">#263</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/d4452a78bbde94995dd3c0d1b4aff3610a5c472f"><code>d4452a7</code></a> Silently discard epilogue data after the closing boundary (<a href="https://redirect.github.com/Kludex/python-multipart/issues/259">#259</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/6a7b76dd2653d99d8e5981d7ff09a4a047750b37"><code>6a7b76d</code></a> Skip preamble before first multipart boundary (<a href="https://redirect.github.com/Kludex/python-multipart/issues/262">#262</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/4addb60350fc843f77a1502f14247db91930b3bf"><code>4addb60</code></a> Version 0.0.25 (<a href="https://redirect.github.com/Kludex/python-multipart/issues/261">#261</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/d3a4698e0dc16cbd85f98076b2ebf9b696cd3604"><code>d3a4698</code></a> Add MIME content type info to File (<a href="https://redirect.github.com/Kludex/python-multipart/issues/143">#143</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/9a1ecbd074801fcd3911266f3f4442181d10ab92"><code>9a1ecbd</code></a> Handle CTE values case-insensitively (<a href="https://redirect.github.com/Kludex/python-multipart/issues/258">#258</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/ef2a0b94f95676ea6a7b77d2252b09f5797cb8ed"><code>ef2a0b9</code></a> Remove custom FormParser classes (<a href="https://redirect.github.com/Kludex/python-multipart/issues/257">#257</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/3a757d7cf209e654eb17cf7b7af868eed469f680"><code>3a757d7</code></a> Ignore local Claude state (<a href="https://redirect.github.com/Kludex/python-multipart/issues/255">#255</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/55e739617db7c40e2cd04c5ad8c7acf2ed0a1d19"><code>55e7396</code></a> fuzz: Add cifuzz (<a href="https://redirect.github.com/Kludex/python-multipart/issues/186">#186</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/d6d1d111e7de9ce3d3f8623fe5f5e4201c0a5fd1"><code>d6d1d11</code></a> Bump the github-actions group with 2 updates (<a href="https://redirect.github.com/Kludex/python-multipart/issues/249">#249</a>)</li> <li>Additional commits viewable in <a href="https://github.com/Kludex/python-multipart/compare/0.0.22...0.0.26">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
4fb5abcc66 |
Python: Bump nbconvert from 7.17.0 to 7.17.1 in /python (#13906)
Bumps [nbconvert](https://github.com/jupyter/nbconvert) from 7.17.0 to 7.17.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jupyter/nbconvert/releases">nbconvert's releases</a>.</em></p> <blockquote> <h2>v7.17.1</h2> <h2>7.17.1</h2> <p>This is a security release, fixing two CVEs:</p> <ul> <li><a href="https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg">CVE-2026-39377</a></li> <li><a href="https://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9">CVE-2026-39378</a></li> </ul> <p>(full advisories will be published seven days after release, on 2026-04-14).</p> <p>(<a href="https://github.com/jupyter/nbconvert/compare/v7.17.0...b3b6ec01f872e9af8fd1769eb9cf1889c720ecf3">Full Changelog</a>)</p> <h3>Enhancements made</h3> <ul> <li>Allow configureable WebPDF JavaScript processing timeout <a href="https://redirect.github.com/jupyter/nbconvert/pull/2250">#2250</a> (<a href="https://github.com/timkpaine"><code>@timkpaine</code></a>, <a href="https://github.com/Carreau"><code>@Carreau</code></a>)</li> </ul> <h3>Bugs fixed</h3> <ul> <li>Fix <code>PermissionError</code> when checking template paths on shared filesystems <a href="https://redirect.github.com/jupyter/nbconvert/pull/2252">#2252</a> (<a href="https://github.com/ctcjab"><code>@ctcjab</code></a>, <a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> <li>Tweak webpdf template logic to fix duplicate extension problem <a href="https://redirect.github.com/jupyter/nbconvert/pull/2249">#2249</a> (<a href="https://github.com/timkpaine"><code>@timkpaine</code></a>, <a href="https://github.com/Carreau"><code>@Carreau</code></a>)</li> </ul> <h3>Maintenance and upkeep improvements</h3> <ul> <li>specify python version for pre <a href="https://redirect.github.com/jupyter/nbconvert/pull/2276">#2276</a> (<a href="https://github.com/minrk"><code>@minrk</code></a>, <a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> </ul> <h3>Contributors to this release</h3> <p>The following people contributed discussions, new ideas, code and documentation contributions, and review. See <a href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports">our definition of contributors</a>.</p> <p>(<a href="https://github.com/jupyter/nbconvert/graphs/contributors?from=2026-01-29&to=2026-04-08&type=c">GitHub contributors page for this release</a>)</p> <p><a href="https://github.com/akhmerov"><code>@akhmerov</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aakhmerov+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/bollwyvl"><code>@bollwyvl</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Abollwyvl+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/Carreau"><code>@Carreau</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/ctcjab"><code>@ctcjab</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Actcjab+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/davidbrochart"><code>@davidbrochart</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Adavidbrochart+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/Ken-B"><code>@Ken-B</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AKen-B+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/krassowski"><code>@krassowski</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Akrassowski+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/mgeier"><code>@mgeier</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Amgeier+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/minrk"><code>@minrk</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/mpacer"><code>@mpacer</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Ampacer+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/MSeal"><code>@MSeal</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AMSeal+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/SylvainCorlay"><code>@SylvainCorlay</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ASylvainCorlay+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/takluyver"><code>@takluyver</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atakluyver+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/timkpaine"><code>@timkpaine</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atimkpaine+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>)</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jupyter/nbconvert/blob/main/CHANGELOG.md">nbconvert's changelog</a>.</em></p> <blockquote> <h2>7.17.1</h2> <p>This is a security release, fixing two CVEs:</p> <ul> <li><a href="https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg">CVE-2026-39377</a></li> <li><a href="https://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9">CVE-2026-39378</a></li> </ul> <p>(full advisories will be published seven days after release, on 2026-04-14).</p> <p>(<a href="https://github.com/jupyter/nbconvert/compare/v7.17.0...b3b6ec01f872e9af8fd1769eb9cf1889c720ecf3">Full Changelog</a>)</p> <h3>Enhancements made</h3> <ul> <li>Allow configureable WebPDF JavaScript processing timeout <a href="https://redirect.github.com/jupyter/nbconvert/pull/2250">#2250</a> (<a href="https://github.com/timkpaine"><code>@timkpaine</code></a>, <a href="https://github.com/Carreau"><code>@Carreau</code></a>)</li> </ul> <h3>Bugs fixed</h3> <ul> <li>Fix <code>PermissionError</code> when checking template paths on shared filesystems <a href="https://redirect.github.com/jupyter/nbconvert/pull/2252">#2252</a> (<a href="https://github.com/ctcjab"><code>@ctcjab</code></a>, <a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> <li>Tweak webpdf template logic to fix duplicate extension problem <a href="https://redirect.github.com/jupyter/nbconvert/pull/2249">#2249</a> (<a href="https://github.com/timkpaine"><code>@timkpaine</code></a>, <a href="https://github.com/Carreau"><code>@Carreau</code></a>)</li> </ul> <h3>Maintenance and upkeep improvements</h3> <ul> <li>specify python version for pre <a href="https://redirect.github.com/jupyter/nbconvert/pull/2276">#2276</a> (<a href="https://github.com/minrk"><code>@minrk</code></a>, <a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> </ul> <h3>Contributors to this release</h3> <p>The following people contributed discussions, new ideas, code and documentation contributions, and review. See <a href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports">our definition of contributors</a>.</p> <p>(<a href="https://github.com/jupyter/nbconvert/graphs/contributors?from=2026-01-29&to=2026-04-08&type=c">GitHub contributors page for this release</a>)</p> <p><a href="https://github.com/akhmerov"><code>@akhmerov</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aakhmerov+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/bollwyvl"><code>@bollwyvl</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Abollwyvl+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/Carreau"><code>@Carreau</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/ctcjab"><code>@ctcjab</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Actcjab+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/davidbrochart"><code>@davidbrochart</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Adavidbrochart+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/Ken-B"><code>@Ken-B</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AKen-B+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/krassowski"><code>@krassowski</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Akrassowski+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/mgeier"><code>@mgeier</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Amgeier+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/minrk"><code>@minrk</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/mpacer"><code>@mpacer</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Ampacer+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/MSeal"><code>@MSeal</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AMSeal+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/SylvainCorlay"><code>@SylvainCorlay</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ASylvainCorlay+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/takluyver"><code>@takluyver</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atakluyver+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>) | <a href="https://github.com/timkpaine"><code>@timkpaine</code></a> (<a href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atimkpaine+updated%3A2026-01-29..2026-04-08&type=Issues">activity</a>)</p> <!-- raw HTML omitted --> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jupyter/nbconvert/commit/78ed30837a607deab7cf0a12dca072bf3f63417a"><code>78ed308</code></a> Publish 7.17.1</li> <li><a href="https://github.com/jupyter/nbconvert/commit/f090a64606fde4c7f87cbf478f51b4aa46a425ec"><code>f090a64</code></a> ruff format</li> <li><a href="https://github.com/jupyter/nbconvert/commit/b3b6ec01f872e9af8fd1769eb9cf1889c720ecf3"><code>b3b6ec0</code></a> chore: update pre-commit hooks (<a href="https://redirect.github.com/jupyter/nbconvert/issues/2277">#2277</a>)</li> <li><a href="https://github.com/jupyter/nbconvert/commit/be4841f7da51c499b1937e41e6e71926dbe0daa3"><code>be4841f</code></a> ignore silly security lint in tests</li> <li><a href="https://github.com/jupyter/nbconvert/commit/26d57b295870f5572d9bd0535acee4a120339c10"><code>26d57b2</code></a> fix type annotation on Lexer</li> <li><a href="https://github.com/jupyter/nbconvert/commit/0e6b8ccabf2aca6c18fac8c574f22b7155f441fb"><code>0e6b8cc</code></a> Merge commit from fork</li> <li><a href="https://github.com/jupyter/nbconvert/commit/ba5e5cdd737704388251fa55fa9e58f5752fa39d"><code>ba5e5cd</code></a> Merge commit from fork</li> <li><a href="https://github.com/jupyter/nbconvert/commit/1db0c88d865146ce02b6405a8d96753d3d0cd0c2"><code>1db0c88</code></a> Specify python version for pre (<a href="https://redirect.github.com/jupyter/nbconvert/issues/2276">#2276</a>)</li> <li><a href="https://github.com/jupyter/nbconvert/commit/7473fc3037a6317bff54380e3a7162d73bf089b3"><code>7473fc3</code></a> chore: update pre-commit hooks (<a href="https://redirect.github.com/jupyter/nbconvert/issues/2242">#2242</a>)</li> <li><a href="https://github.com/jupyter/nbconvert/commit/4322f7f290694929f414cefadc942111afad3762"><code>4322f7f</code></a> Bump the actions group across 1 directory with 2 updates (<a href="https://redirect.github.com/jupyter/nbconvert/issues/2273">#2273</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jupyter/nbconvert/compare/v7.17.0...v7.17.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
5dad51381a |
Python: Bump onnxruntime from 1.22.1 to 1.24.3 in /python (#13868)
Bumps [onnxruntime](https://github.com/microsoft/onnxruntime) from 1.22.1 to 1.24.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/microsoft/onnxruntime/releases">onnxruntime's releases</a>.</em></p> <blockquote> <h2>ONNX Runtime v1.24.3</h2> <p>This is a patch release for ONNX Runtime 1.24, containing bug fixes, security improvements, performance enhancements, and execution provider updates.</p> <h2>Security Fixes</h2> <ul> <li><strong>Core</strong>: Fixed GatherCopyData integer truncation leading to heap out-of-bounds read/write. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27444">#27444</a>)</li> <li><strong>Core</strong>: Fixed RoiAlign heap out-of-bounds read via unchecked batch_indices. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27543">#27543</a>)</li> <li><strong>Core</strong>: Prevent heap OOB from maliciously crafted Lora Adapters. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27518">#27518</a>)</li> <li><strong>Core</strong>: Fixed out-of-bounds access for Resize operation. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27419">#27419</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li><strong>Core</strong>: Fixed GatherND division by zero when batch dimensions mismatch. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27090">#27090</a>)</li> <li><strong>Core</strong>: Fixed validation for external data paths for models loaded from bytes. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27430">#27430</a>)</li> <li><strong>Core</strong>: Fixed SkipLayerNorm fusion incorrectly applied when gamma/beta are not 1D. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27459">#27459</a>)</li> <li><strong>Core</strong>: Fixed double-free in TRT EP custom op domain Release functions. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27471">#27471</a>)</li> <li><strong>Core</strong>: Fixed QMoE CPU Operator. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27360">#27360</a>)</li> <li><strong>Core</strong>: Fixed MatmulNBits prepacking scales. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27412">#27412</a>)</li> <li><strong>Python</strong>: Fixed refcount bug in map input conversion that caused shutdown segfault. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27413">#27413</a>)</li> <li><strong>NuGet</strong>: Fixed DllImportResolver. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27397">#27397</a>)</li> <li><strong>NuGet</strong>: Added <code>OrtEnv.DisableDllImportResolver</code> to prevent fatal error on resolver conflict. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27535">#27535</a>)</li> </ul> <h2>Performance Improvements</h2> <ul> <li><strong>Core</strong>: QMoE CPU performance update (up to 4x on 4-bit). (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27364">#27364</a>)</li> <li><strong>Core</strong>: Fixed O(n²) model load time for TreeEnsemble with categorical feature chains. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27391">#27391</a>)</li> </ul> <h2>Execution Provider Updates</h2> <ul> <li><strong>NvTensorRtRtx EP</strong>: <ul> <li>Avoid repetitive creation of fp4/fp8 native-custom-op domains. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27192">#27192</a>)</li> <li>Added missing override specifiers to suppress warnings. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27288">#27288</a>)</li> <li>DQ→MatMulNBits fusion transformer. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27466">#27466</a>)</li> </ul> </li> <li><strong>WebGPU</strong>: <ul> <li>Used embedded WASM module in Blob URL workers when <code>wasmBinary</code> is provided. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27318">#27318</a>)</li> <li>Fixed usage of <code>wasmBinary</code> together with a blob URL for <code>.mjs</code>. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27411">#27411</a>)</li> <li>Removed the unhelpful "Unknown CPU vendor" warning. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27399">#27399</a>)</li> <li>Allows new memory info name for WebGPU. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27475">#27475</a>)</li> </ul> </li> <li><strong>MLAS</strong>: <ul> <li>Added DynamicQGemm function pointers and ukernel interface. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27403">#27403</a>)</li> <li>Fixed error where bytes is not assigned for dynamic qgemm pack b size. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27421">#27421</a>)</li> </ul> </li> <li><strong>VitisAI EP</strong>: Removed <code>s_kernel_registry_vitisaiep.reset()</code> in <code>deinitialize_vitisai_ep()</code>. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27295">#27295</a>)</li> <li><strong>Plugin EPs</strong>: Added "library_path" metadata entry to <code>OrtEpDevice</code> instances for plugin and provider bridge EPs. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27522">#27522</a>)</li> </ul> <h2>Build and Infrastructure</h2> <ul> <li><strong>Pipelines</strong>: <ul> <li>Build Windows ARM64X binaries as part of packaging pipeline. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27316">#27316</a>)</li> <li>Moved JAR testing pipelines to canonical pipeline template. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27480">#27480</a>)</li> </ul> </li> <li><strong>Python</strong>: Enabled Python 3.14 CI and upgraded dependencies. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27401">#27401</a>)</li> <li><strong>Build</strong>: Suppressed spurious Array Out of Bounds warnings produced by GCC 14.2 compiler on Linux builds. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27454">#27454</a>)</li> <li><strong>Build</strong>: Fixed <code>-Warray-bounds</code> build error in MLAS on clang 17+. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27499">#27499</a>)</li> <li><strong>Telemetry</strong>: Added/Updated telemetry events. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27356">#27356</a>)</li> <li><strong>Config</strong>: Increased <code>kMaxValueLength</code> to 8192. (<a href="https://redirect.github.com/microsoft/onnxruntime/pull/27521">#27521</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/microsoft/onnxruntime/commit/3a728b75062256951b6e19ce718907cf1a1d4cf0"><code>3a728b7</code></a> ORT 1.24.3 release cherry pick round 4 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27558">#27558</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/dd6a8546ab88c47db73f139854eb25130ef27c9e"><code>dd6a854</code></a> ORT 1.24.3 release cherry pick round 3 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27501">#27501</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/15c006bd76d7af722fd71921611583d8834e9338"><code>15c006b</code></a> ORT 1.24.3 release cherry pick round 2 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27492">#27492</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/ee26608ab699fd98c71df4ddff58720fe7ec54db"><code>ee26608</code></a> ORT 1.24.3 release cherry pick round 1 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27476">#27476</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/058787ceead760166e3c50a0a4cba8a833a6f53f"><code>058787c</code></a> ORT 1.24.2 Release cherry pick round 4 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27388">#27388</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/6fc7ee38cdc5755a7e4ab6cdc26c5f73a2d94dd7"><code>6fc7ee3</code></a> ORT 1.24.2 release cherry pick round 3 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27378">#27378</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/98711820882dc178e995ec24f4587350dbf16360"><code>9871182</code></a> ORT 1.24.2 release cherry-pick round 2 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27343">#27343</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/f34d11d3e99abb3b1c2236f33e0e1aa30160b922"><code>f34d11d</code></a> ORT 1.24.2 release cherry pick round 1 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27330">#27330</a>)</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/8ba51c754c3c853e420a38051f76c5d97e78ff89"><code>8ba51c7</code></a> update version to 1.24.2</li> <li><a href="https://github.com/microsoft/onnxruntime/commit/470ae16099a74fe05e31f2530489332c0525edb5"><code>470ae16</code></a> Patch pools to use older agent version on ARM64 (<a href="https://redirect.github.com/microsoft/onnxruntime/issues/27232">#27232</a>)</li> <li>Additional commits viewable in <a href="https://github.com/microsoft/onnxruntime/compare/v1.22.1...v1.24.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: moonbox3 <[email protected]> |
||
|
dependabot[bot]
|
790add7a33 |
Python: Bump authlib from 1.6.9 to 1.6.11 in /python (#13880)
Bumps [authlib](https://github.com/authlib/authlib) from 1.6.9 to 1.6.11. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/authlib/authlib/releases">authlib's releases</a>.</em></p> <blockquote> <h2>v1.6.11</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/authlib/authlib/compare/v1.6.10...v1.6.11">https://github.com/authlib/authlib/compare/v1.6.10...v1.6.11</a></p> <ul> <li>Fix CSRF issue with starlette client</li> </ul> <h2>v1.6.10</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/authlib/authlib/compare/v1.6.9...v1.6.10">https://github.com/authlib/authlib/compare/v1.6.9...v1.6.10</a></p> <ul> <li>Fix redirecting to unvalidated <code>redirect_uri</code> on <code>UnsupportedResponseTypeError</code>.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/authlib/authlib/blob/v1.6.11/docs/changelog.rst">authlib's changelog</a>.</em></p> <blockquote> <h2>Version 1.6.11</h2> <p><strong>Released on Apr 16, 2026</strong></p> <ul> <li>Fix CSRF vulnerability in the Starlette OAuth client when a <code>cache</code> is configured.</li> </ul> <h2>Version 1.6.10</h2> <p><strong>Released on Apr 13, 2026</strong></p> <ul> <li>Fix redirecting to unvalidated <code>redirect_uri</code> on <code>UnsupportedResponseTypeError</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/authlib/authlib/commit/0dc0e5b4dc84f155319518a3732113af6fa47525"><code>0dc0e5b</code></a> chore: bump to 1.6.11</li> <li><a href="https://github.com/authlib/authlib/commit/aa7b8e46e00d0622658666476782042ac00153a5"><code>aa7b8e4</code></a> Merge commit from fork</li> <li><a href="https://github.com/authlib/authlib/commit/401a7709c3fe43bce1b2105d16a475b688faa788"><code>401a770</code></a> fix: CSRF issue with starlette client</li> <li><a href="https://github.com/authlib/authlib/commit/ef09aebbba4439dedb22bd15777d1b3458b6f0ab"><code>ef09aeb</code></a> chore: release 1.6.10</li> <li><a href="https://github.com/authlib/authlib/commit/3be08468201a7766a93012ce149ea12822cab096"><code>3be0846</code></a> fix: redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError</li> <li>See full diff in <a href="https://github.com/authlib/authlib/compare/v1.6.9...v1.6.11">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Evan Mattson
|
ea9981ffaf |
Python: Docs: Add Microsoft Agent Framework successor callout to READMEs (#13932)
## Motivation and Context Now that **Microsoft Agent Framework (MAF)** is the successor SDK to Semantic Kernel, the top-level and per-language READMEs should direct community members — especially newcomers landing here from search, GitHub, PyPI, or NuGet — to MAF for new work, and clearly state SK's ongoing maintenance posture. ## Description Adds a prominent GitHub `> [!IMPORTANT]` callout, placed directly under the existing title/badges block, to: - `README.md` (top-level) - `python/README.md` - `dotnet/README.md` Each callout: - Names MAF as Semantic Kernel's successor SDK and links to https://github.com/microsoft/agent-framework. - Describes MAF as "an open, multi-language framework for building production-grade AI agents and multi-agent workflows in .NET and Python". - Asks readers to use MAF for the latest abstractions to build agents, workflows, and multi-agent orchestrations. - States that Semantic Kernel will continue to receive minimal security and bug fixes only. No other README content is modified; SK identity, badges, install steps, and quickstart samples are preserved. ## Contribution Checklist - [x] The code builds clean without any errors or warnings — docs-only change. - [x] I didn't break anyone — additive callout only. - [x] All relevant CONTRIBUTING.md sections were followed. |