mirror of
https://github.com/microsoft/semantic-kernel.git
synced 2026-10-12 02:19:06 +00:00
dotnet-1.80.1
553
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
|
b371cc6c6f |
Python: update dependencies (#14360)
## Summary - update Transformers and related Hugging Face packages - refresh Python dependencies used by the MCP OAuth demo - regenerate the affected uv lockfiles - adapt the Hugging Face text completion connector to Transformers 5 - temporarily disable live tests that depend on the retired Assistants API ## Hugging Face connector Transformers 5 removes the `text2text-generation`, `summarization` and `translation` pipeline tasks, so `HuggingFaceTextCompletion` raised `KeyError: Unknown task text2text-generation` on construction. Those two tasks now use a small adapter built on `AutoModelForSeq2SeqLM` and `AutoTokenizer` that preserves what the removed pipelines did: - the same output keys (`summary_text` for summarization, `generated_text` otherwise), so the content mapping is unchanged - the model's task specific prefix (e.g. `summarize: `) is still prepended before tokenization - one record per generated sequence when `num_return_sequences > 1` - `model_kwargs` are shared with the tokenizer load, as `pipeline()` did - pipeline only options are dropped with a warning instead of reaching `generate()` `text-generation` keeps using `pipeline()`. There is no public API change. The previous unit tests mocked `pipeline()` and so did not catch the incompatibility. New tests cover the adapter, option routing, device placement, output mapping and prefix resolution. ## Temporarily disabled tests The OpenAI and Azure OpenAI Assistants API has been retired. Live requests now return HTTP 410 (`assistants_api_deprecated`) on Azure OpenAI and HTTP 404 on OpenAI, so these tests cannot exercise a functioning service. - all 30 parametrized cases in `tests/integration/agents/openai_assistant_agent/test_openai_assistant_agent_integration.py` are skipped at module level, before the live-service fixture runs - the `step1_openai_assistant` case in `tests/samples/test_concepts.py` is skipped unconditionally - the other concept samples are unchanged - all 103 tests under `tests/unit/agents/openai_assistant` remain enabled and passing The skips are intentionally limited to live tests for the retired API. Comments next to each skip include the migration guide and state that the skip should be removed after the agents and sample move to the replacement API. ## Validation - uv lock consistency checks - 35 Hugging Face unit tests pass - all 12 deliberate connector mutations used to assess regression coverage were detected by the unit tests - all 103 Assistants agent unit tests pass - 30 live Assistants integration cases and the one retired-API concept sample report as skipped before making service requests - the three text completion services used by the integration suite were exercised against their real models on Transformers 5, for both completion and streaming - Ruff check and formatting pass --------- Co-authored-by: Evan Mattson <[email protected]> Co-authored-by: Copilot App <[email protected]> Copilot-Session: c2d4dd29-0a9c-4f43-b2ce-243e19ec34b2 |
||
|
SergeyMenshykh
|
b39d95a344 |
Python: [Breaking] Remove unsupported service auth mode from Copilot Studio agent (#14306)
### Motivation and Context The Copilot Studio agent exposed a `SERVICE` authentication mode that was never reachable — it was guarded to always raise before its implementation ran. Its dormant credential handling also triggered certificate-related static analysis alerts. ### Description Removes the service authentication path along with its settings, parameters, tests, and documentation. `CopilotStudioAgentAuthMode` is kept with its `INTERACTIVE` member, which is the only supported mode. Interactive authentication is unchanged. Service authentication can be reintroduced later as a complete, tested feature. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 --------- Copilot-Session: 25dd6e2a-f759-4148-a630-40110e90eff2 |
||
|
SergeyMenshykhandCopilot App
|
b5877044eb |
Python: Skip MCP tools and prompts whose normalized names collide (#14236)
### Motivation and Context MCP tool and prompt name normalization is many-to-one, so two remote names can produce the same local name. The second registration silently replaced the first. ### Description Track normalized names already registered by the plugin and skip colliding tools or prompts with a warning instead of overwriting. Reloading the same remote item still refreshes it. Adds unit tests. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the SK Contribution Guidelines - [x] All unit tests pass, and I have added new tests where possible --------- Co-authored-by: Copilot App <[email protected]> Copilot-Session: 4cab25f4-d987-42b3-bb34-e8d8a7185c80 |
||
|
SergeyMenshykh
|
3da48a3d01 |
Python: [Breaking] Add MCP tool approval callback for Azure AI Agent (#14210)
## Summary - Add an Azure AI Agent callback for MCP tool approval requests. - Route MCP tool approval submissions through a shared helper in thread actions. - Add unit coverage for approval, denial, callback failures, and per-call decisions. ## Testing - python -m pytest tests/unit/agents/azure_ai_agent --------- Copilot-Session: 3e190979-228b-4a82-8e63-5ad14bd4879f |
||
|
westey
|
7481cd062b |
Fix cosmosdb vectorstore bug (#14182)
### Motivation and Context <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
Eduard van ValkenburgandCopilot
|
dd026f3413 |
Encode OpenAPI server variable values (#14146)
## Summary - validate enum-constrained OpenAPI server variables before substitution - percent-encode substituted server variable values, including defaults - add regression tests for invalid enum values and reserved-character encoding ## Testing - uv run pytest tests/unit/connectors/openapi_plugin/test_sk_openapi.py -q --------- Co-authored-by: Copilot <[email protected]> |
||
|
|
3df33f7862 |
Python: [Breaking] Update runtime handling (#14135)
This PR updates Python runtime handling and related tests. --------- Co-authored-by: Copilot <[email protected]> Co-authored-by: Evan Mattson <[email protected]> |
||
|
Roger Barreto
|
f6391ad8b6 |
Python: OpenApi: Harden operation path handling for consistent selection and request targeting (.Net & Python) (#14140)
## Motivation and Context The OpenAPI plugin imports operations from a spec and lets the host restrict which operations are exposed via an `OperationSelectionPredicate` (and via `OperationsToExclude`). Operation selection and request-URL construction should share one canonical interpretation of an operation path. This change closes two consistency gaps where a spec-supplied path could be interpreted differently at selection time than at request time. 1. **Selection vs. request path normalization.** The selection predicate received the raw operation path, while the request URL is built from a canonicalized path. An encoded dot-segment (for example `%2e%2e`) is textually different from the endpoint it canonicalizes to, so it could pass a path-based include/exclude filter yet resolve to a different route. Operations whose path contains an encoded or literal dot-segment are now excluded before the predicate is consulted, symmetric with the existing request-time dot-segment rejection. 2. **Request target reconciliation (defense in depth).** After the request URL is built, verify it did not move off the configured server. An operation path that is an absolute or authority-changing URI (for example `https://another-host/admin`) carries no dot-segment, so it passes path-segment validation, yet `System.Uri` / `urljoin` resolve it to a different scheme, host, or port. Such a request is now rejected before it is sent, so a credential-bearing request cannot be redirected to an unintended target. Both changes are applied symmetrically to the .NET and Python OpenAPI ports. ## Description - **.NET** - `OpenApiDocumentParser` skips operations whose path contains a dot-segment before invoking the selection predicate. - `RestApiOperation` extracts a shared `ContainsDotSegment` helper (reused by the existing `ValidatePathSegments`) and, after building the request URL, reconciles its scheme/host/port and base path against the configured server. - **Python** - `openapi_parser` skips dot-segment operations before the predicate runs. - `rest_api_operation` adds a shared `_contains_dot_segment` helper and a post-construction `_ensure_request_target_matches_server` reconciliation. ## Tests - .NET: added selection-exclusion and request-target reconciliation tests; full `Functions.UnitTests` OpenApi suite green (488). - Python: added parity tests for both behaviors; `tests/unit/connectors/openapi_plugin` green (173), ruff + ruff-format + mypy + pre-commit clean. ## Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the SK Contribution Guidelines - [x] All unit tests pass, and I have added new tests where possible |
||
|
SergeyMenshykhandCopilot
|
efa3268a09 |
Python: Enforce excluded_functions on MCP tool invocation path (#14124)
### Motivation and Context The MCP server created by `create_mcp_server_from_kernel` (and the `Kernel.as_mcp_server` wrapper) accepts an `excluded_functions` argument to keep selected kernel functions off the server. Previously this list was applied only when building the tool set advertised by the `list_tools` handler; the `call_tool` handler did not consult it and forwarded the client-supplied name straight to the kernel. As a result the set of advertised tools and the set of callable tools could diverge. ### Description - Derive a single `exposed_names` set from `functions_to_expose` and check it in the `call_tool` handler, returning a `METHOD_NOT_FOUND` error for any name that is not exposed. - Remove a leftover `print` debug statement in `_call_kernel_function`. - Add a unit test covering the `call_tool` behavior for a non-exposed function. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the SK Contribution Guidelines - [x] All unit tests pass, and I have added new tests where possible --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
88e1060b99 |
Python: Adjust request validation (#14114)
Updates request validation behavior and related tests. --------- Co-authored-by: Copilot <[email protected]> |
||
|
Eduard van ValkenburgandCopilot
|
83bffe197b |
Python: Add OpenAPI server URL validation (#14097)
## Summary - Add server URL validation for Python OpenAPI operation execution before outbound requests are made - Add execution settings for trusted allowed base URLs and private-network access - Pass operation arguments into server variable resolution and add regression coverage for substituted server hosts ## Testing - `uv run pytest tests/unit/connectors/openapi_plugin/test_server_url_validator.py tests/unit/connectors/openapi_plugin/test_openapi_runner.py tests/unit/connectors/openapi_plugin/test_openapi_manager.py tests/unit/connectors/openapi_plugin/test_sk_openapi.py` - `uv run pytest tests/integration/cross_language/test_cross_language.py -k openapi` - `uv run ruff check ...` - `uv run ruff format --check ...` --------- Co-authored-by: Copilot <[email protected]> |
||
|
dependabot[bot]andcopilot-swe-agent[bot]
|
91efa2120c |
Python: Bump bleach from 6.3.0 to 6.4.0 in /python (#14089)
Bumps [bleach](https://github.com/mozilla/bleach) from 6.3.0 to 6.4.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/mozilla/bleach/blob/main/CHANGES">bleach's changelog</a>.</em></p> <blockquote> <h2>Version 6.4.0 (June 5th, 2026)</h2> <p><strong>NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues.</strong> See issue: <code><https://github.com/mozilla/bleach/issues/698></code>__</p> <p><strong>Backwards incompatible changes</strong></p> <ul> <li>Dropped support for pypy 3.10. (<a href="https://redirect.github.com/mozilla/bleach/issues/764">#764</a>)</li> </ul> <p><strong>Security fixes</strong></p> <ul> <li> <p>Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.</p> <p>Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.</p> <p>For example::</p> <p>import bleach payload1 = '<!-- raw HTML omitted -->Click<!-- raw HTML omitted -->' result1 = bleach.clean(payload1) print(repr(result1))</p> <p>outputs::</p> <p>'<!-- raw HTML omitted -->Click<!-- raw HTML omitted -->'</p> <p>See the advisory for details.</p> </li> <li> <p>Fix GHSA-gj48-438w-jh9v.</p> <p>Fix issue where URI sanitization wasn't happening in formaction attributes.</p> <p>See the advisory for details.</p> </li> </ul> <p><strong>Bug fixes</strong></p> <ul> <li> <p>Add support for pypy 3.11. (<a href="https://redirect.github.com/mozilla/bleach/issues/764">#764</a>)</p> </li> <li> <p>Drop version max in tinycss2 pin. (<a href="https://redirect.github.com/mozilla/bleach/issues/772">#772</a>)</p> <p>This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mozilla/bleach/commit/f0355a7af00500482c5292c6c83290c6a178068d"><code>f0355a7</code></a> fix: fix last release date in CHANGES</li> <li><a href="https://github.com/mozilla/bleach/commit/ae4e8a26706516ad01b92e66321b480208a440da"><code>ae4e8a2</code></a> chore: bleach 6.4.0 and final release</li> <li><a href="https://github.com/mozilla/bleach/commit/970df58e9f0c55cc52244f3f0106e473a40d886d"><code>970df58</code></a> fix: uri-sanitization in formaction attributes</li> <li><a href="https://github.com/mozilla/bleach/commit/7c4867c32344d1c961107fae62240a6f0dc680dc"><code>7c4867c</code></a> fix: xss bypass in allowed protocol test using unicode invisible characters</li> <li><a href="https://github.com/mozilla/bleach/commit/913ab75992b845e2c9c060c41f24d46921db4693"><code>913ab75</code></a> fix: reduce redundancy in workflow jobs</li> <li><a href="https://github.com/mozilla/bleach/commit/218c15af455c8dec14f98fcb2e235f8680e93930"><code>218c15a</code></a> fix: rework pip caching</li> <li><a href="https://github.com/mozilla/bleach/commit/4f0b097bf80548a022050e2f71f024d755a9f154"><code>4f0b097</code></a> fix: fix tox platform restrictions</li> <li><a href="https://github.com/mozilla/bleach/commit/e95a79d07bb5d792425c2bc0ef5dd03f6614f3bb"><code>e95a79d</code></a> chore: update pytest</li> <li><a href="https://github.com/mozilla/bleach/commit/91539d4e80d4685b8f2bedc79076ff0ff6c1b911"><code>91539d4</code></a> Bump actions/cache from 5.0.3 to 5.0.4</li> <li><a href="https://github.com/mozilla/bleach/commit/cd47b4ce495859065da23c2116f651e591e1e90d"><code>cd47b4c</code></a> fix: handle left-angle-bracket that's not a tag (<a href="https://redirect.github.com/mozilla/bleach/issues/733">#733</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mozilla/bleach/compare/v6.3.0...v6.4.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> |
||
|
dependabot[bot]andcopilot-swe-agent[bot]
|
356aed0986 |
Python: Bump starlette from 0.52.1 to 1.3.1 in /python (#14092)
Bumps [starlette](https://github.com/Kludex/starlette) from 0.52.1 to 1.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p> <blockquote> <h2>Version 1.3.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>StarletteDeprecationWarning</code> instead of <code>DeprecationWarning</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3119">Kludex/starlette#3119</a></li> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3329">Kludex/starlette#3329</a></li> <li>Enforce <code>FormParser</code> limits in parser callbacks by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3331">Kludex/starlette#3331</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.3.0...1.3.1">https://github.com/Kludex/starlette/compare/1.3.0...1.3.1</a></p> <h2>Version 1.3.0</h2> <h2>What's Changed</h2> <ul> <li>Clamp oversized suffix ranges in <code>FileResponse</code> by <a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files by <a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li>Add <code>httpx2</code> to the <code>full</code> extra by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3323">Kludex/starlette#3323</a></li> <li>Adjust testclient typing and warnings by <a href="https://github.com/waketzheng"><code>@waketzheng</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3322">Kludex/starlette#3322</a></li> <li>Fix IndexError in URL.replace() on a URL with no authority by <a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li>Annotate URLPath protocol parameter with Literal by <a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li>avoid collapsing exception groups from user code by <a href="https://github.com/graingert"><code>@graingert</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/2830">Kludex/starlette#2830</a></li> <li>Use <code>removeprefix</code> to strip weak ETag indicator in <code>is_not_modified</code> by <a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> <li>Build <code>request.url</code> from structured components by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3326">Kludex/starlette#3326</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li><a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li><a href="https://github.com/leestana01"><code>@leestana01</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3319">Kludex/starlette#3319</a></li> <li><a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li><a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3204">Kludex/starlette#3204</a></li> <li><a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li><a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.1...1.3.0">https://github.com/Kludex/starlette/compare/1.2.1...1.3.0</a></p> <h2>Version 1.2.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module by <a href="https://github.com/leifwar"><code>@leifwar</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li>Add assert error for requires() when request param is not Request type by <a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/leifwar"><code>@leifwar</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li><a href="https://github.com/diskeu"><code>@diskeu</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3243">Kludex/starlette#3243</a></li> <li><a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.0...1.2.1">https://github.com/Kludex/starlette/compare/1.2.0...1.2.1</a></p> <h2>Version 1.2.0</h2> <h2>What's Changed</h2> <ul> <li>Support httpx2 in the test client by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3291">Kludex/starlette#3291</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.1.0...1.2.0">https://github.com/Kludex/starlette/compare/1.1.0...1.2.0</a></p> <h2>Version 1.1.0</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p> <blockquote> <h2>1.3.1 (June 12, 2026)</h2> <h4>Fixed</h4> <ul> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> <a href="https://redirect.github.com/encode/starlette/pull/3329">#3329</a>.</li> <li>Enforce <code>FormParser</code> limits in parser callbacks <a href="https://redirect.github.com/encode/starlette/pull/3331">#3331</a>.</li> </ul> <h2>1.3.0 (June 11, 2026)</h2> <h4>Added</h4> <ul> <li>Add <code>httpx2</code> to the <code>full</code> extra <a href="https://redirect.github.com/encode/starlette/pull/3323">#3323</a>.</li> <li>Annotate the <code>URLPath</code> <code>protocol</code> parameter with <code>Literal</code> <a href="https://redirect.github.com/encode/starlette/pull/3285">#3285</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Build <code>request.url</code> from structured components <a href="https://redirect.github.com/encode/starlette/pull/3326">#3326</a>.</li> <li>Clamp oversized suffix ranges in <code>FileResponse</code> <a href="https://redirect.github.com/encode/starlette/pull/3307">#3307</a>.</li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files <a href="https://redirect.github.com/encode/starlette/pull/3191">#3191</a>.</li> <li>Avoid collapsing exception groups raised from user code <a href="https://redirect.github.com/encode/starlette/pull/2830">#2830</a>.</li> <li>Use <code>removeprefix</code> to strip the weak <code>ETag</code> indicator in <code>is_not_modified</code> <a href="https://redirect.github.com/encode/starlette/pull/3193">#3193</a>.</li> <li>Fix <code>IndexError</code> in <code>URL.replace()</code> on a URL with no authority <a href="https://redirect.github.com/encode/starlette/pull/3317">#3317</a>.</li> <li>Adjust <code>testclient</code> typing and warnings <a href="https://redirect.github.com/encode/starlette/pull/3322">#3322</a>.</li> </ul> <h2>1.2.1 (May 31, 2026)</h2> <h4>Fixed</h4> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module <a href="https://redirect.github.com/encode/starlette/pull/3304">#3304</a>.</li> <li>Add assert error for <code>requires()</code> when the request parameter is not a <code>Request</code> type <a href="https://redirect.github.com/encode/starlette/pull/3298">#3298</a>.</li> </ul> <h2>1.2.0 (May 28, 2026)</h2> <h4>Added</h4> <ul> <li>Support httpx2 in the test client <a href="https://redirect.github.com/encode/starlette/pull/3291">#3291</a>.</li> </ul> <h2>1.1.0 (May 23, 2026)</h2> <h4>Added</h4> <ul> <li>Use <code>"application/octet-stream"</code> as the <code>FileResponse</code> media type fallback <a href="https://redirect.github.com/encode/starlette/pull/3283">#3283</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Only dispatch standard HTTP verbs in <code>HTTPEndpoint</code> <a href="https://redirect.github.com/encode/starlette/pull/3286">#3286</a>.</li> <li>Reject absolute paths in <code>StaticFiles.lookup_path</code> <a href="https://redirect.github.com/encode/starlette/pull/3287">#3287</a>.</li> </ul> <h2>1.0.1 (May 21, 2026)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Kludex/starlette/commit/8ebffd0678570ddd5d5bb11c6f3c3c7fd4682ab9"><code>8ebffd0</code></a> Version 1.3.1 (<a href="https://redirect.github.com/Kludex/starlette/issues/3330">#3330</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/25b8e179d8d7ed86769c02f648772dd5fb43dc3c"><code>25b8e17</code></a> Enforce <code>FormParser</code> limits in parser callbacks (<a href="https://redirect.github.com/Kludex/starlette/issues/3331">#3331</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/dba1c4babc4f99ad2622bb913d87045775dda735"><code>dba1c4b</code></a> Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3329">#3329</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/45e51dcf99f3a270b0bcec1aec5410b4345863a9"><code>45e51dc</code></a> Use <code>StarletteDeprecationWarning</code> instead of <code>DeprecationWarning</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3119">#3119</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/5f8610c386e13de1d80d36efa961e1486a1d2d01"><code>5f8610c</code></a> Version 1.3.0 (<a href="https://redirect.github.com/Kludex/starlette/issues/3327">#3327</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/167b5850e809f38b27fbfed62d58bf6442855975"><code>167b585</code></a> Build <code>request.url</code> from structured components (<a href="https://redirect.github.com/Kludex/starlette/issues/3326">#3326</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/37309255b4c1b9c381a2d24a1eaf83100984a16a"><code>3730925</code></a> Use <code>removeprefix</code> to strip weak ETag indicator in <code>is_not_modified</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3193">#3193</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/e6f7ad1ab85efb27ab7910d8007b3f4531f7b083"><code>e6f7ad1</code></a> avoid collapsing exception groups from user code (<a href="https://redirect.github.com/Kludex/starlette/issues/2830">#2830</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/115228fcdca0e0ef5bf4a95a40ddce5a9fced428"><code>115228f</code></a> Annotate URLPath protocol parameter with Literal (<a href="https://redirect.github.com/Kludex/starlette/issues/3285">#3285</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/113f193a34353c9153857028c1074351d22fad07"><code>113f193</code></a> docs: replace inline ASGI server list with link to canonical implemen… (<a href="https://redirect.github.com/Kludex/starlette/issues/3204">#3204</a>)</li> <li>Additional commits viewable in <a href="https://github.com/Kludex/starlette/compare/0.52.1...1.3.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/semantic-kernel/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <[email protected]> |
||
|
Roger Barreto
|
6ba60965bd |
Python: Reject encoded dot-segment paths in OpenAPI plugin (.NET and Python) (#14086)
## Motivation and Context Closes #14085. The .NET and Python OpenAPI plugins select operations using the raw OpenAPI path, but build the runtime request URL from a canonicalized path. Encoded dot-segments such as `/resources/%2e%2e/admin` pass an `OperationSelectionPredicate` path check, yet `System.Uri` (.NET) and `urljoin` (Python) collapse them to a different route at request time. The selected path and the actual request target can therefore diverge. ## Description - **.NET** (`RestApiOperation.ValidatePathSegments`): decodes each path segment until stable (handling double encoding like `%252e` and encoded separators `%2f`/`%5c`) before rejecting canonical `.` or `..` segments. - **Python** (`RestApiOperation.build_path`): adds equivalent decode-then-reject validation before the URL is built. Regression tests on both stacks cover literal and encoded dot-segments, mixed case, encoded slashes, and double encoding, plus negative tests confirming legitimate encoded characters still work. Test results: - .NET: 482/482 `Functions.UnitTests` OpenApi tests pass. - Python: 109/109 `openapi_plugin` unit tests pass. ## Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the SK Contribution Guidelines - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 |
||
|
SergeyMenshykhandCopilot
|
61331d834d |
Python: Add function_choice_behavior support to Azure AI and OpenAI Assistant agents (#14057)
### Description Adds `function_choice_behavior` parameter to Azure AI and OpenAI Assistant agents, aligning them with the existing Responses agent and Chat Completion agent APIs. ### Changes - Add `function_choice_behavior` parameter to `invoke`/`invoke_stream`/`get_response` on both `AzureAIAgent` and `OpenAIAssistantAgent` public APIs - Add `function_choice_behavior` parameter to internal `AzureAIAgentThreadActions` and `AssistantThreadActions` `invoke`/`invoke_stream` methods - Support `tools` parameter override for SDK-level tools (CodeInterpreter, FileSearch, etc.) - Filter kernel functions based on `FunctionChoiceBehavior` configuration - Validate that only `Auto` type with auto-invoke enabled is supported - Fix `_get_tools` in OpenAI path to use passed `kernel` parameter instead of `agent.kernel` - Add comprehensive unit tests for both thread actions and public agent APIs --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
644eb0a962 |
Python: [Breaking] Update OpenAPI document parsing options (#14009)
Update OpenAPI document parsing to gate file and HTTP ref resolution separately. ### Breaking change - `RESOLVE_FILES` is no longer enabled by default. Only internal JSON pointer references are resolved by default. - Users with multi-file OpenAPI specs must now pass `enable_file_ref_resolution=True` via `OpenAPIFunctionExecutionParameters`. - `enable_external_ref_resolution` has been renamed to `enable_http_ref_resolution`. --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
58f4a66858 |
Python: Improve function call invocation parameter consistency (#14014)
## Description This PR improves the consistency of how the function_behavior parameter is passed through internal invoke_function_call callsites. ### Changes - Thread function_behavior parameter through all internal invoke_function_call callsites for consistent parameter handling: - Realtime connector (_open_ai_realtime.py) - Responses agent (responses_agent_thread_actions.py) - Assistant agent (assistant_thread_actions.py) - Azure AI agent (agent_thread_actions.py) - Bedrock agent (bedrock_agent.py) - Add defensive logging in kernel.py when function_behavior is not provided - Add unit tests covering parameter handling scenarios ### Testing - All existing tests pass (678 passed, 0 failed) - 5 new tests added covering the updated parameter handling Co-authored-by: Copilot <[email protected]> |
||
|
Evan MattsonandCopilot
|
a6c68af594 |
Python: Improvements for MCP (#14003)
### Motivation and Context Improvements for MCP tool calls by adding an optional sampling callback. <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Improvements for MCP tool calls by adding an optional sampling callback. <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
32abf99e29 |
Python: Harden HttpPlugin request validation (#13969)
Improve input validation and request handling in the Python HttpPlugin. ### Changes - Add explicit opt-in for unrestricted domain access - Tighten URL validation logic - Improve redirect handling when domain restrictions are configured - Add regression tests --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
a7cea9ab64 |
Python: Stop accessing private Azure SDK attributes in Azure AI Search connector (#13971)
### Motivation and Context CI fails with `AttributeError: 'SearchIndexClient' object has no attribute '_endpoint'` when `azure-search-documents` resolves to 12.0.0 (released 2026-04-01). The 12.0.0 release migrated from AutoRest to TypeSpec code generation, removing private attributes `_endpoint` and `_credential` from `SearchIndexClient`. CI uses `uv sync -U` which upgrades past the lockfile, pulling in 12.0.0 since `pyproject.toml` specifies `>= 11.6.0b4` with no upper bound. ### Description Stop reading `SearchIndexClient._endpoint` and `._credential`. Instead, store endpoint and credential as explicit fields on `AzureAISearchStore` and `AzureAISearchCollection`, and pass them directly when constructing `SearchClient`. **Changes:** - `_get_search_client()` accepts explicit `endpoint` + `credential` params instead of extracting from `SearchIndexClient` private attrs - `_resolve_credential()` new helper extracted from `_get_search_index_client()` for reuse - `AzureAISearchStore` / `AzureAISearchCollection` store `search_endpoint` and `search_credential` as fields, thread them through construction - Tests updated to assert on public fields instead of private SDK attributes ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] All unit tests pass with both `azure-search-documents==11.7.0b2` and `==12.0.0` - [x] No breaking changes to public API --------- Co-authored-by: Copilot <[email protected]> |
||
|
SergeyMenshykhandCopilot
|
3f0e2d58fa |
Python: Percent-encode OpenAPI path params & pin azure-search-documents (#13967)
Apply `urllib.parse.quote(safe='')` to path parameter values before substitution in `build_path()`, consistent with the .NET implementation which uses `HttpUtility.UrlEncode`. ### Changes - `rest_api_operation.py`: encode path parameter values per RFC 3986 - `test_sk_openapi.py`: add tests for encoded path parameters - `pyproject.toml` / `uv.lock`: pin `azure-search-documents >= 11.6.0b4, < 12.0.0` ### Pin azure-search-documents < 12.0.0 Version 12.0.0 removed the internal `_endpoint` attribute from `SearchIndexClient`, which breaks `AzureAISearchCollection` initialization at `azure_ai_search.py:158`. Pinning to `< 12.0.0` until the code is updated to use the new public API. ### Tests All existing and new `build_path` tests pass. --------- Co-authored-by: Copilot <[email protected]> |
||
|
Evan Mattson
|
79ef93b9cf |
Python: Extend InMemoryCollection filter attribute blocklist (#13897)
## Summary - Minor defense-in-depth hardening for `InMemoryCollection` filter parsing. - Extends the internal dunder attribute blocklist and adds a regression test covering the blocked set. ## Test plan - [x] `uv run pytest tests/unit/connectors/memory/test_in_memory.py` |
||
|
westey
|
57d9adce81 |
Python: Add field and table name escaping for python SqlServer connector (#13893)
### Motivation and Context ### Description - Add field and table name escaping for python SqlServer connector ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
ふぁーandEvan Mattson
|
eeeccb4596 |
Python: Respect FunctionChoiceBehavior filters in OpenAI responses agent tools (#13235)
issue: https://github.com/microsoft/semantic-kernel/issues/13234 ## Summary - honor FunctionChoiceBehavior filters when retrieving kernel function metadata ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 --------- Co-authored-by: Evan Mattson <[email protected]> |
||
|
|
0f322bcc48 |
Python: Improve prompt-template msg serialize and sample usage (#13738)
### Motivation and Context This PR updates the Jinja2 and Handlebars prompt-template helpers to serialize chat messages through the existing XML/message serializer instead of assembling message XML manually. It also aligns the prompt-template samples with the serializer-backed helper and adds regression coverage for common message content. <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Prompt template message serialize improvements. <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 --------- Co-authored-by: MAF Dashboard Bot <[email protected]> Co-authored-by: Copilot <[email protected]> |
||
|
|
41f7b59595 |
Python: fix Google AI/Vertex AI crash on anyOf schema (#12442) (#13624)
### Motivation and Context Closes #12442 When `ChatCompletionAgent` instances are used as plugins with `GoogleAIChatCompletion`, the application crashes with: ``` ValueError: Unknown field for Schema: anyOf ``` **Root cause**: The Semantic Kernel JSON schema builder generates `anyOf` for Union types (e.g. `str | list[str]` on the agent's `messages` parameter) and type-as-array for Optional types (e.g. `["string", "null"]`). Google AI's protobuf `Schema` does not support these constructs. ### Description Add `sanitize_schema_for_google_ai()` to `shared_utils.py` that recursively rewrites unsupported schema constructs: - `anyOf` / `oneOf` with a null variant → single type + `nullable: true` - `anyOf` / `oneOf` without null → picks the first variant - `type` as array (e.g. `["string", "null"]`) → single type + `nullable: true` Applied in both `kernel_function_metadata_to_google_ai_function_call_format()` and `kernel_function_metadata_to_vertex_ai_function_call_format()`. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) - [x] The existing tests pass, and I have added 12 new regression tests - [x] I didn't break any existing functionality > [!NOTE] > AI-assisted contribution: Claude helped with code review, test generation, and formatting. --------- Co-authored-by: Claude Opus 4.6 <[email protected]> Co-authored-by: Evan Mattson <[email protected]> |
||
|
|
83ff0a5aaa |
Python: fix(google-ai): skip api_key check when use_vertexai is True (#13607)
## Summary Fixes #13483 ### Motivation and Context When `use_vertexai=True`, users authenticate via Application Default Credentials (ADC) and don't need an API key. However, the initialization check for `api_key` runs unconditionally, blocking Vertex AI users with: ``` ServiceInitializationError: The API key is required when use_vertexai is False. ``` ### Description Guard the `api_key` validation with `not google_ai_settings.use_vertexai` in all three Google AI service classes: - `GoogleAIChatCompletion` - `GoogleAITextCompletion` - `GoogleAITextEmbedding` The error message already reads *"when use_vertexai is False"*, so the condition now matches the intent. ### Before / After ```python # Before — fails even with use_vertexai=True GoogleAIChatCompletion( use_vertexai=True, cloud_project_id="my-project", cloud_region="us-central1" ) # → ServiceInitializationError: The API key is required when use_vertexai is False. # After — works correctly GoogleAIChatCompletion( use_vertexai=True, cloud_project_id="my-project", cloud_region="us-central1" ) # → Initializes successfully, uses ADC for authentication ``` ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) - [x] The code follows the [SK coding standards](https://github.com/microsoft/semantic-kernel/blob/main/python/README.md) --------- Co-authored-by: giulio-leone <[email protected]> Co-authored-by: giulio-leone <[email protected]> Co-authored-by: Copilot <[email protected]> |
||
|
|
e0bd528cd9 |
Python: Default Dapr module allowlist to semantic_kernel prefix (#13596)
### Motivation and Context Follow-up to #13499. The previous PR added the `allowed_module_prefixes` parameter but defaulted it to `None`, which meant the module restriction was only active if developers discovered and configured it. Secure-by-default is the right posture here — restrict first, let developers widen as needed. - Change `allowed_module_prefixes` default from `None` to `("semantic_kernel.",)` across Dapr runtime step loading - Non-SK step classes now require developers to explicitly add their module prefix (e.g. `("semantic_kernel.", "myapp.steps.")`) - Developers can pass `None` to opt out entirely, but the secure default is now enforced - The Dapr runtime code is experimental, so this is a non-breaking change per our stability guarantees <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 --------- Co-authored-by: MAF Dashboard Bot <[email protected]> Co-authored-by: Copilot <[email protected]> |
||
|
|
f034ed1d4c |
Python: fix: ChatHistoryTruncationReducer orphans TOOL role messages (#13608)
## Summary Fixes #12708 `ChatHistoryTruncationReducer.reduce()` can orphan `TOOL` role messages by truncating the preceding `assistant` message that contains the `tool_calls`, causing OpenAI to reject the history with: ``` messages with role 'tool' must be a response to a preceding message with 'tool_calls' ``` ## Root Cause `locate_safe_reduction_index()` uses `contains_function_call_or_result()` to detect tool-related messages during its backward scan. This function only checks `msg.items` for `FunctionCallContent`/`FunctionResultContent` instances. However, `TOOL` role messages can contain only text content (no `FunctionResultContent` in `items`), which causes the backward scan to treat them as regular messages. The truncation point then lands between the `tool_calls` assistant message and its `TOOL` responses, orphaning the tool results. ## Fix Added `AuthorRole.TOOL` check to `contains_function_call_or_result()`: ```python if msg.role == AuthorRole.TOOL: return True ``` This ensures **any** `TOOL` role message is recognized as part of a tool call/result pair, regardless of whether it has `FunctionResultContent` in its `items`. ## Test Added `test_locate_safe_reduction_index_tool_role_without_function_result_content` that verifies TOOL role messages with only text content are not separated from their tool call. --------- Co-authored-by: giulio-leone <[email protected]> Co-authored-by: Evan Mattson <[email protected]> Co-authored-by: Copilot <[email protected]> |
||
|
|
3c1b688dcf |
Python: Fix ChatHistoryTruncationReducer deleting system prompt (#13610)
## Summary `ChatHistoryTruncationReducer.reduce()` silently deletes system/developer messages when truncating chat history. This is because it calls `extract_range()`, which unconditionally filters out system/developer messages — a function designed for the summarization use case, not truncation. Fixes #12612. ## Approach Port the .NET SDK fix (PR #10344) to Python: 1. Detect the first system/developer message before truncation 2. Pass `has_system_message=True` to `locate_safe_reduction_index` so `target_count` accounts for the preserved message (matches .NET's `targetCount -= hasSystemMessage ? 1 : 0`) 3. Use a simple `history[truncation_index:]` slice instead of `extract_range` (which strips system messages) 4. Prepend the system message if it was truncated away Also adds a guard for `target_count <= 0` after the system message adjustment to prevent `IndexError` when `target_count=1`. ## Changes | File | Change | |------|--------| | `chat_history_reducer_utils.py` | Add `has_system_message` parameter, adjust `target_count`, guard against `<= 0` | | `chat_history_truncation_reducer.py` | Detect system message, bypass `extract_range`, prepend if truncated | | `test_chat_history_truncation_reducer.py` | Update 2 existing tests + 4 new tests (system, developer, no-system, target_count=1) | ## Note The summarization reducer (`ChatHistorySummarizationReducer`) has the same bug — it also uses `extract_range` and loses system messages during summarization. The .NET summarization reducer preserves system messages via `AssemblySummarizedHistory`. This should be addressed in a follow-up PR to keep this change focused. ## Test plan - [x] 11/11 truncation reducer tests pass (was 7, now 11) - [x] 9/9 utils tests pass (no regressions from new parameter) - [x] 11/11 summarization reducer tests pass (unaffected) - [x] Reproduces and fixes the exact scenario from #12612 - [x] Edge case: `target_count=1` with system message does not crash --------- Co-authored-by: Claude Opus 4.6 <[email protected]> Co-authored-by: Evan Mattson <[email protected]> |
||
|
Weiguang LiandEvan Mattson
|
e500f727ed |
Python: fix prompt template engine blocking HTML tags in content (#13633)
### Motivation and Context Fixes #13632 When a prompt contains HTML tags such as `<p>`, `<div>`, `<b>`, etc., the `ChatHistory.from_rendered_prompt()` method wraps the rendered prompt in a `<root>` element and parses it as XML. Any child elements whose tag names do not match the known SK template tags (`message`, `chat_history`) were silently skipped, causing their text content to be lost. This meant a prompt like: ``` Translate: "<p>What is your name?</p>" ``` would arrive at the LLM as an empty message, because `<p>What is your name?</p>` was discarded during XML traversal. ### Description In `ChatHistory.from_rendered_prompt`, when an XML child element has an unrecognized tag (i.e. it is not `message` or `chat_history`), the element is now serialized back to its original text representation and appended to the preceding message content. The element's tail text is likewise kept in the same message, preserving the full original prompt text. **Changed files:** - `python/semantic_kernel/contents/chat_history.py` -- handle unknown XML tags as literal text in `from_rendered_prompt()` - `python/tests/unit/contents/test_chat_history.py` -- added four regression tests covering HTML `<p>`, multiple HTML tags, HTML surrounded by text, and SK tags mixed with HTML ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) - [x] The existing tests pass and new tests have been added - [x] I didn't break any existing functionality --------- Co-authored-by: Evan Mattson <[email protected]> |
||
|
Evan Mattson
|
3f6d72725f |
Python: Fix image integration tests that are now blocked due to bot policies (#13680)
### Motivation and Context Fix image integration tests that are now blocked due to bot policies <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Fix image integration tests that are now blocked due to bot policies <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
|
cc83889787 |
Python: fix(python/google): preserve thought_signature in Gemini function call parts (#13609)
### Motivation and Context Fixes #13480 When using Gemini models (2.5 Pro / 3 Pro) with thinking enabled, the API returns a `thought_signature` on function call `Part` objects. Per [Google's Thought Signatures documentation](https://ai.google.dev/gemini-api/docs/thought-signatures), this signature **must** be included in subsequent requests. Without it, follow-up turns with tool results fail with: ``` HTTP 400: Function call is missing a thought_signature in functionCall parts ``` The .NET connector was already fixed in #13418. This PR applies the equivalent fix to the Python connector. ### Description **Response parsing** (capture `thought_signature`): - `google_ai_chat_completion.py`: When creating `FunctionCallContent` from response parts, capture `part.thought_signature` into `FunctionCallContent.metadata` (both non-streaming and streaming paths) - `vertex_ai_chat_completion.py`: Same capture via `part_dict.get("thought_signature")` for Vertex AI **Request building** (restore `thought_signature`): - `google_ai/services/utils.py`: In `format_assistant_message()`, when a `FunctionCallContent` has `thought_signature` in its metadata, construct the `Part` directly with the `thought_signature` parameter instead of using `Part.from_function_call()` - `vertex_ai/services/utils.py`: In `format_assistant_message()`, include `thought_signature` in the `Part.from_dict()` dictionary when present **Backward compatible**: When `thought_signature` is not present (thinking disabled or older models), behavior is identical to before. ### Test Coverage Added 4 new tests: - `test_format_assistant_message_with_thought_signature` (Google AI) — verifies round-trip preservation - `test_format_assistant_message_without_thought_signature` (Google AI) — verifies backward compatibility - `test_format_assistant_message_with_thought_signature` (Vertex AI) — verifies round-trip preservation - `test_format_assistant_message_without_thought_signature` (Vertex AI) — verifies backward compatibility All 110 existing Google connector tests continue to pass. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) - [x] All unit tests pass, and I have added new tests - [x] I didn't break anyone 😄 --------- Co-authored-by: giulio-leone <[email protected]> Co-authored-by: Copilot <[email protected]> |
||
|
Tao ChenandEvan Mattson
|
5c891d1769 |
Python: Add support to new openai text to image model (#13651)
### Motivation and Context <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> Dall-e-3 and Dall-e-2 have been deprecated. The newer gpt-1-image model returns base64 strings. ### Description <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> Return url if set, otherwise return the base64 string. ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 --------- Co-authored-by: Evan Mattson <[email protected]> |
||
|
Eduard van Valkenburg
|
c250b379f6 |
Python: Refinement of in memory vector collection filter (#13637)
### Motivation and Context <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> Fixes another way of escaping allowed commands. ### Description <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
Tao Chen
|
d5c2b9d889 |
Python: Improves the robustness of filename handling (#13643)
### Motivation and Context <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> Improves the robustness of filename handling in the Bedrock agent integration. Ensures that filenames sourced from external responses are properly sanitized before use in file operations, and adds safer defaults for file write behavior. ### Description <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> 1. Sanitize filenames received from Bedrock agent responses. 2. Add overwrite parameter to BinaryContent.write_to_file (defaults to False). 3. Add tests. 4. Update samples. ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
Evan Mattson
|
429dd1c4c0 |
Python: support (Azure) OpenAI realtime audio models (#13291)
### Motivation and Context As of 2/27/2026, revived the PR, and the latest code is working for both Azure OpenAI realtime models and OpenAI realtime models. SK has support for realtime-preview models; however, since they've gone to GA we have not added support for the latest library abstractions. This PR brings in the changes to support running models like `gpt-realtime-1.5`, `gpt-realtime`, `gpt-realtime-mini` or `gpt-audio`. <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description - Closes #13267 - Code now relies on `openai` >= 2.0 - Considered a breaking change due some new config added to the execution settings. <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
Evan Mattson
|
b6f95e2c45 |
Python: Add class validation for Dapr Runtime step loading (#13499)
### Motivation and Context The Dapr Runtime uses string-based class names to load step classes dynamically. This PR adds validation to ensure that only valid KernelProcessStep subclasses can be loaded and instantiated, improving type safety and providing better error messages when misconfigured. The new allowed_module_prefixes parameter gives users control over which modules are permitted for step class loading, which can be useful in environments where stricter control is desired. <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description - Add issubclass(cls, KernelProcessStep) validation when loading step classes from qualified names - Add optional allowed_module_prefixes parameter for restricting which modules can be loaded - Centralize class loading logic in get_step_class_from_qualified_name() utility function - Remove duplicate _get_class_from_string methods from DaprStepInfo and StepActor <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
Roger Barreto
|
5b27a727a2 |
Python: Add file upload security controls to SessionsPythonPlugin (#13478)
Overriding merge checks as there are unrelated Python integration test failures ### Motivation and Context - Uploads: Require both EnableDangerousFileUploads = true AND AllowedUploadDirectories configured - Downloads: Permissive by default, but if AllowedDownloadDirectories is configured, path validation applies - Both use path canonicalization to prevent traversal attacks ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 |
||
|
Evan Mattson
|
e696dc7d52 |
Python: Add directory allowlist configuration for SessionsPythonTool file (#13467)
### Motivation and Context
When `SessionsPythonTool` is used with an AI model, providing explicit
directory boundaries for file operations gives developers fine-grained
control over which parts of the filesystem the plugin can access. This
follows the pattern established by `HttpPlugin.allowed_domains`.
- Add `allowed_upload_directories` parameter to control which local
directories can be used for file uploads
- Add `allowed_download_directories` parameter for optional restrictions
on file download destinations
- Implement path canonicalization to resolve symlinks and normalize
paths
Usage:
```python
tool = SessionsPythonTool(
credential=credential,
allowed_upload_directories={"/app/data/uploads", "/app/user_files"},
allowed_download_directories={"/app/data/downloads"}, # optional
)
```
<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
1. Why is this change required?
2. What problem does it solve?
3. What scenario does it contribute to?
4. If it fixes an open issue, please link to the issue here.
-->
### Description
- `upload_file` now requires `allowed_upload_directories` to be
configured (deny-by-default)
- `download_file` optionally supports `allowed_download_directories`
(permissive-by-default, since it's not exposed as a kernel function)
- Both parameters accept `set[str]` or `list[str]` for convenience
- Paths are canonicalized using `os.path.realpath()` before validation
<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
### Contribution Checklist
<!-- Before submitting this PR, please make sure: -->
- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄
|
||
|
Eduard van Valkenburg
|
72bc02551f |
Python: added allowed_domains to HttpPlugin (#13462)
### Motivation and Context <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> Adds allowed_domains setup for HttpPlugin. ### Description <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 |
||
|
Eduard van Valkenburg
|
f511c965c1 |
Python: inversed the filter logic for InMemory vector stores (#13457)
### Motivation and Context <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> Fixes some issues with the forbidden list approach for the in-memory vector store filtering. ### Description <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
Evan Mattson
|
adb71bc63b |
Python: Bump to v1.39.1 for a release (#13455)
### Motivation and Context Bump to v1.39.1 for a release <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Description Bump to v1.39.1 for a release <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
Dmytro Struk
|
dc7c1c0484 |
Python: Updated Copilot Studio README (#13432)
### Motivation and Context <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> Renamed dependency from Copilot Studio README. ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 |
||
|
Monita
|
e1fbafe552 |
Python: feat(oracle): add new Oracle connector for Semantic Kernel (#13229)
…ync support ### Motivation and Context <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> This change is required to enable Semantic Kernel users to store and retrieve embeddings using Oracle databases. Currently, Semantic Kernel supports vector storage for several backends, but Oracle was missing. This connector solves that gap by providing full async support, native VECTOR type handling, and vector index management. ### Description <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> This PR introduces a new Oracle connector for Semantic Kernel with the following features: - Asynchronous upsert, get, delete and search operations for memory records. - Native Oracle VECTOR type support for storing embeddings efficiently. - Support for HNSW and IVFFLAT vector indexes for similarity search. - Integration with Semantic Kernel collections, enabling semantic search and memory operations. - Comprehensive unit tests to ensure correctness and stability. The connector is designed to work seamlessly with existing Semantic Kernel memory abstractions and follows the same async patterns as other vector stores. Integration tests have also been implemented and verified locally; however, they are not included in this PR because the current CI environment setup for Oracle Database support is unknown. Once guidance is provided on Oracle DB availability in the CI pipeline, integration tests can be enabled and added in a follow-up PR. ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 |
||
|
Tao Chen
|
d84363f477 |
Python: Migrate to new Google GenAI SDK (#13371)
### Motivation and Context <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> Closes #12970, #13352 ### Description <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> 1. Migrate Google AI connector to use the new Google AI SDK. 2. This PR also marks the VertexAI connector as deprecated in favor of the Google AI connector. With this update, if users wants to connect to a VertexAI project instead of a Google AI endpoint, they can do so with the Google AI connector. 3. This PR also adds the ability for users to provide a custom client to the Google AI connector (#13352). 4. This PR also marks `AzureTextCompletion` deprecated. ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
Nico MöllerandEvan Mattson
|
145ad9bfd2 |
Python: Upgrade Onnx Connector to use 0.9.0 (#13162)
### Motivation and Context Fixes : #13001 ### Description Package version 0.9.0 introduced very helpful methods like applying chat templates automatically from the tokenizer and also support for multi audio & image files. This PR adds the following functionalities: - [x] Add Inference with multiple Images - [x] Add Inference with multiple Audios - [x] Chat Templates for non Multimodal Models are read via onnx ### Samples Text Sample with ONNX: <img width="1728" height="90" alt="image" src="https://github.com/user-attachments/assets/b93d9fc1-4e38-4fa9-b535-cc316e0900ed" /> Image Sample with ONNX : <img width="1721" height="91" alt="image" src="https://github.com/user-attachments/assets/47761beb-b728-4936-a6b6-fd253e041689" /> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 --------- Co-authored-by: Evan Mattson <[email protected]> |
||
|
Tao Chen
|
b2cceb5985 |
.Net: Update OTel GenAI operation names (#13334)
### Motivation and Context <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> OTel GenAI operation names have the following updates: 1. `chat.completion` to `chat` 2. `text.completion` to `text_completion` ### Description <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> This PR updates those operation names ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 |
||
|
Evan Mattson
|
05d659d6e9 |
Python: Fix non-string KernelArguments being converted to strings in prompt template function calls (#13292)
### Motivation and Context Fixes #13199 - Non-string kernel arguments are now preserved when passed to functions in prompt templates. Adds unit tests. <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [X] The code builds clean without any errors or warnings - [X] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [X] All unit tests pass, and I have added new tests where possible - [X] I didn't break anyone 😄 |
||
|
|
1f8fea2b49 |
Python: Fix ai connector integration tests (#13311)
### Motivation and Context <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> Vertex AI and Bedrock integration tests have been failing. ### Description <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> 1. This PR fixes the vertex ai integration tests by upgrading the Google AI SDK version. 2. This PR fixes the Bedrock integration tests by upgrading the models. ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 --------- Co-authored-by: Copilot <[email protected]> Co-authored-by: moonbox3 <[email protected]> |