dependabot[bot] 620e412c70 Python: Bump werkzeug from 3.1.1 to 3.1.6 in /python (#13605)
Bumps [werkzeug](https://github.com/pallets/werkzeug) from 3.1.1 to
3.1.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pallets/werkzeug/releases">werkzeug's
releases</a>.</em></p>
<blockquote>
<h2>3.1.6</h2>
<p>This is the Werkzeug 3.1.6 security fix release, which fixes a
security issue but does not otherwise change behavior and should not
result in breaking changes compared to the latest feature release.</p>
<p>PyPI: <a
href="https://pypi.org/project/Werkzeug/3.1.6/">https://pypi.org/project/Werkzeug/3.1.6/</a>
Changes: <a
href="https://werkzeug.palletsprojects.com/page/changes/#version-3-1-6">https://werkzeug.palletsprojects.com/page/changes/#version-3-1-6</a></p>
<ul>
<li><code>safe_join</code> on Windows does not allow special devices
names in multi-segment paths. <a
href="https://github.com/pallets/werkzeug/security/advisories/GHSA-29vq-49wr-vm6x">GHSA-29vq-49wr-vm6x</a></li>
</ul>
<h2>3.1.5</h2>
<p>This is the Werkzeug 3.1.5 security fix release, which fixes security
issues and bugs but does not otherwise change behavior and should not
result in breaking changes compared to the latest feature release.</p>
<p>PyPI: <a
href="https://pypi.org/project/Werkzeug/3.1.5/">https://pypi.org/project/Werkzeug/3.1.5/</a>
Changes: <a
href="https://werkzeug.palletsprojects.com/page/changes/#version-3-1-5">https://werkzeug.palletsprojects.com/page/changes/#version-3-1-5</a>
Milestone: <a
href="https://github.com/pallets/werkzeug/milestone/43?closed=1">https://github.com/pallets/werkzeug/milestone/43?closed=1</a></p>
<ul>
<li><code>safe_join</code> on Windows does not allow more special device
names, regardless of extension or surrounding spaces. <a
href="https://github.com/pallets/werkzeug/security/advisories/GHSA-87hc-h4r5-73f7">GHSA-87hc-h4r5-73f7</a></li>
<li>The multipart form parser handles a <code>\r\n</code> sequence at a
chunk boundary. This fixes the previous attempt, which caused incorrect
content lengths. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3065">#3065</a>
<a
href="https://redirect.github.com/pallets/werkzeug/issues/3077">#3077</a></li>
<li>Fix <code>AttributeError</code> when initializing
<code>DebuggedApplication</code> with <code>pin_security=False</code>.
<a
href="https://redirect.github.com/pallets/werkzeug/issues/3075">#3075</a></li>
</ul>
<h2>3.1.4</h2>
<p>This is the Werkzeug 3.1.4 fix release, which fixes bugs but does not
otherwise change behavior and should not result in breaking changes
compared to the latest feature release.</p>
<p>PyPI: <a
href="https://pypi.org/project/Werkzeug/3.1.4/">https://pypi.org/project/Werkzeug/3.1.4/</a>
Changes: <a
href="https://werkzeug.palletsprojects.com/page/changes/#version-3-1-4">https://werkzeug.palletsprojects.com/page/changes/#version-3-1-4</a>
Milestone: <a
href="https://github.com/pallets/werkzeug/milestone/42?closed=1">https://github.com/pallets/werkzeug/milestone/42?closed=1</a></p>
<ul>
<li><code>safe_join</code> on Windows does not allow special device
names. This prevents reading from these when using
<code>send_from_directory</code>. <code>secure_filename</code> already
prevented writing to these. <a
href="https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2">ghsa-hgf8-39gv-g3f2</a></li>
<li>The debugger pin fails after 10 attempts instead of 11. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3020">#3020</a></li>
<li>The multipart form parser handles a <code>\r\n</code> sequence at a
chunk boundary. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3065">#3065</a></li>
<li>Improve CPU usage during Watchdog reloader. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3054">#3054</a></li>
<li><code>Request.json</code> annotation is more accurate. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3067">#3067</a></li>
<li>Traceback rendering handles when the line number is beyond the
available source lines. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3044">#3044</a></li>
<li><code>HTTPException.get_response</code> annotation and doc better
conveys the distinction between WSGI and sans-IO responses. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3056">#3056</a></li>
</ul>
<h2>3.1.3</h2>
<p>This is the Werkzeug 3.1.3 fix release, which fixes bugs but does not
otherwise change behavior and should not result in breaking changes vs
3.1.0.</p>
<p>PyPI: <a
href="https://pypi.org/project/Werkzeug/3.1.3/">https://pypi.org/project/Werkzeug/3.1.3/</a>
Changes: <a
href="https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-3">https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-3</a>
Milestone: <a
href="https://github.com/pallets/werkzeug/milestone/41?closed=1">https://github.com/pallets/werkzeug/milestone/41?closed=1</a></p>
<ul>
<li>Initial data passed to <code>MultiDict</code> and similar interfaces
only accepts <code>list</code>, <code>tuple</code>, or <code>set</code>
when passing multiple values. It had been changed to accept any
<code>Collection</code>, but this matched types that should be treated
as single values, such as <code>bytes</code>. <a
href="https://redirect.github.com/pallets/werkzeug/issues/2994">#2994</a></li>
<li>When the <code>Host</code> header is not set and
<code>Request.host</code> falls back to the WSGI
<code>SERVER_NAME</code> value, if that value is an IPv6 address it is
wrapped in <code>[]</code> to match the <code>Host</code> header. <a
href="https://redirect.github.com/pallets/werkzeug/issues/2993">#2993</a></li>
</ul>
<h2>3.1.2</h2>
<p>This is the Werkzeug 3.1.2 fix release, which fixes bugs but does not
otherwise change behavior and should not result in breaking changes vs
3.1.0.</p>
<p>PyPI: <a
href="https://pypi.org/project/Werkzeug/3.1.2/">https://pypi.org/project/Werkzeug/3.1.2/</a>
Changes: <a
href="https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-2">https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-2</a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pallets/werkzeug/blob/main/CHANGES.rst">werkzeug's
changelog</a>.</em></p>
<blockquote>
<h2>Version 3.1.6</h2>
<p>Released 2026-02-19</p>
<ul>
<li><code>safe_join</code> on Windows does not allow special devices
names in
multi-segment paths. :ghsa:<code>29vq-49wr-vm6x</code></li>
</ul>
<h2>Version 3.1.5</h2>
<p>Released 2026-01-08</p>
<ul>
<li><code>safe_join</code> on Windows does not allow more special device
names, regardless
of extension or surrounding spaces.
:ghsa:<code>87hc-h4r5-73f7</code></li>
<li>The multipart form parser handles a <code>\r\n</code> sequence at a
chunk boundary.
This fixes the previous attempt, which caused incorrect content lengths.
:issue:<code>3065</code> :issue:<code>3077</code></li>
<li>Fix <code>AttributeError</code> when initializing
<code>DebuggedApplication</code> with
<code>pin_security=False</code>. :issue:<code>3075</code></li>
</ul>
<h2>Version 3.1.4</h2>
<p>Released 2025-11-28</p>
<ul>
<li><code>safe_join</code> on Windows does not allow special device
names. This prevents
reading from these when using <code>send_from_directory</code>.
<code>secure_filename</code>
already prevented writing to these.
:ghsa:<code>hgf8-39gv-g3f2</code></li>
<li>The debugger pin fails after 10 attempts instead of 11.
:pr:<code>3020</code></li>
<li>The multipart form parser handles a <code>\r\n</code> sequence at a
chunk boundary.
:issue:<code>3065</code></li>
<li>Improve CPU usage during Watchdog reloader.
:issue:<code>3054</code></li>
<li><code>Request.json</code> annotation is more accurate.
:issue:<code>3067</code></li>
<li>Traceback rendering handles when the line number is beyond the
available
source lines. :issue:<code>3044</code></li>
<li><code>HTTPException.get_response</code> annotation and doc better
conveys the
distinction between WSGI and sans-IO responses.
:issue:<code>3056</code></li>
</ul>
<h2>Version 3.1.3</h2>
<p>Released 2024-11-08</p>
<ul>
<li>Initial data passed to <code>MultiDict</code> and similar interfaces
only accepts
<code>list</code>, <code>tuple</code>, or <code>set</code> when passing
multiple values. It had been
changed to accept any <code>Collection</code>, but this matched types
that should be</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pallets/werkzeug/commit/04da1b5221b7a7b57e82246e4b5741d37a6b2e56"><code>04da1b5</code></a>
release version 3.1.6</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/f407712fdc60a09c2b3f4fe7db557703e5d9338d"><code>f407712</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/f54fe98026253e70fbbcd35a6b52fb67cfff1c03"><code>f54fe98</code></a>
safe_join prevents Windows special device names in multi-segment
paths</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/d005985ef69ffe3275eda8fb6fb25e074dbe871b"><code>d005985</code></a>
start version 3.1.6</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/8565c2cbd6681ae8463e77d4fc0795324a7fdae7"><code>8565c2c</code></a>
document rule priority (<a
href="https://redirect.github.com/pallets/werkzeug/issues/3102">#3102</a>)</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/3febc7e90072bffe04c27e6b7478dfc4f88930df"><code>3febc7e</code></a>
document rule priority</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/2525b827646c10ab7adb334664e6a4af1b769181"><code>2525b82</code></a>
remove state machine docs</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/4abfbd553cdeb6d4e6fa693340d52b13c884079f"><code>4abfbd5</code></a>
rewrite build docstring (<a
href="https://redirect.github.com/pallets/werkzeug/issues/3097">#3097</a>)</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/161c18b2a8800ae6ef377fb3cbdb933a878fea67"><code>161c18b</code></a>
rewrite build docstring</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/86e11c29e44726dae524cd9db11549b3b1ad681d"><code>86e11c2</code></a>
release version 3.1.5 (<a
href="https://redirect.github.com/pallets/werkzeug/issues/3085">#3085</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pallets/werkzeug/compare/3.1.1...3.1.6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=werkzeug&package-manager=uv&previous-version=3.1.1&new-version=3.1.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/microsoft/semantic-kernel/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-19 11:20:39 +00:00
2023-09-04 19:55:35 +00:00
2023-02-24 16:38:23 -08:00

Semantic Kernel

Build intelligent AI agents and multi-agent systems with this enterprise-ready orchestration framework

License: MIT Python package Nuget package Discord

What is Semantic Kernel?

Semantic Kernel is a model-agnostic SDK that empowers developers to build, orchestrate, and deploy AI agents and multi-agent systems. Whether you're building a simple chatbot or a complex multi-agent workflow, Semantic Kernel provides the tools you need with enterprise-grade reliability and flexibility.

System Requirements

  • Python: 3.10+
  • .NET: .NET 10.0+
  • Java: JDK 17+
  • OS Support: Windows, macOS, Linux

Key Features

  • Model Flexibility: Connect to any LLM with built-in support for OpenAI, Azure OpenAI, Hugging Face, NVidia and more
  • Agent Framework: Build modular AI agents with access to tools/plugins, memory, and planning capabilities
  • Multi-Agent Systems: Orchestrate complex workflows with collaborating specialist agents
  • Plugin Ecosystem: Extend with native code functions, prompt templates, OpenAPI specs, or Model Context Protocol (MCP)
  • Vector DB Support: Seamless integration with Azure AI Search, Elasticsearch, Chroma, and more
  • Multimodal Support: Process text, vision, and audio inputs
  • Local Deployment: Run with Ollama, LMStudio, or ONNX
  • Process Framework: Model complex business processes with a structured workflow approach
  • Enterprise Ready: Built for observability, security, and stable APIs

Installation

First, set the environment variable for your AI Services:

Azure OpenAI:

export AZURE_OPENAI_API_KEY=AAA....

or OpenAI directly:

export OPENAI_API_KEY=sk-...

Python

pip install semantic-kernel

.NET

dotnet add package Microsoft.SemanticKernel
dotnet add package Microsoft.SemanticKernel.Agents.Core

Java

See semantic-kernel-java build for instructions.

Quickstart

Basic Agent - Python

Create a simple assistant that responds to user prompts:

import asyncio
from semantic_kernel.agents import ChatCompletionAgent
from semantic_kernel.connectors.ai.open_ai import AzureChatCompletion

async def main():
    # Initialize a chat agent with basic instructions
    agent = ChatCompletionAgent(
        service=AzureChatCompletion(),
        name="SK-Assistant",
        instructions="You are a helpful assistant.",
    )

    # Get a response to a user message
    response = await agent.get_response(messages="Write a haiku about Semantic Kernel.")
    print(response.content)

asyncio.run(main()) 

# Output:
# Language's essence,
# Semantic threads intertwine,
# Meaning's core revealed.

Basic Agent - .NET

using Microsoft.SemanticKernel;
using Microsoft.SemanticKernel.Agents;

var builder = Kernel.CreateBuilder();
builder.AddAzureOpenAIChatCompletion(
                Environment.GetEnvironmentVariable("AZURE_OPENAI_DEPLOYMENT"),
                Environment.GetEnvironmentVariable("AZURE_OPENAI_ENDPOINT"),
                Environment.GetEnvironmentVariable("AZURE_OPENAI_API_KEY")
                );
var kernel = builder.Build();

ChatCompletionAgent agent =
    new()
    {
        Name = "SK-Agent",
        Instructions = "You are a helpful assistant.",
        Kernel = kernel,
    };

await foreach (AgentResponseItem<ChatMessageContent> response 
    in agent.InvokeAsync("Write a haiku about Semantic Kernel."))
{
    Console.WriteLine(response.Message);
}

// Output:
// Language's essence,
// Semantic threads intertwine,
// Meaning's core revealed.

Agent with Plugins - Python

Enhance your agent with custom tools (plugins) and structured output:

import asyncio
from typing import Annotated
from pydantic import BaseModel
from semantic_kernel.agents import ChatCompletionAgent
from semantic_kernel.connectors.ai.open_ai import AzureChatCompletion, OpenAIChatPromptExecutionSettings
from semantic_kernel.functions import kernel_function, KernelArguments

class MenuPlugin:
    @kernel_function(description="Provides a list of specials from the menu.")
    def get_specials(self) -> Annotated[str, "Returns the specials from the menu."]:
        return """
        Special Soup: Clam Chowder
        Special Salad: Cobb Salad
        Special Drink: Chai Tea
        """

    @kernel_function(description="Provides the price of the requested menu item.")
    def get_item_price(
        self, menu_item: Annotated[str, "The name of the menu item."]
    ) -> Annotated[str, "Returns the price of the menu item."]:
        return "$9.99"

class MenuItem(BaseModel):
    price: float
    name: str

async def main():
    # Configure structured output format
    settings = OpenAIChatPromptExecutionSettings()
    settings.response_format = MenuItem

    # Create agent with plugin and settings
    agent = ChatCompletionAgent(
        service=AzureChatCompletion(),
        name="SK-Assistant",
        instructions="You are a helpful assistant.",
        plugins=[MenuPlugin()],
        arguments=KernelArguments(settings)
    )

    response = await agent.get_response(messages="What is the price of the soup special?")
    print(response.content)

    # Output:
    # The price of the Clam Chowder, which is the soup special, is $9.99.

asyncio.run(main()) 

Agent with Plugin - .NET

using System.ComponentModel;
using Microsoft.SemanticKernel;
using Microsoft.SemanticKernel.Agents;
using Microsoft.SemanticKernel.ChatCompletion;

var builder = Kernel.CreateBuilder();
builder.AddAzureOpenAIChatCompletion(
                Environment.GetEnvironmentVariable("AZURE_OPENAI_DEPLOYMENT"),
                Environment.GetEnvironmentVariable("AZURE_OPENAI_ENDPOINT"),
                Environment.GetEnvironmentVariable("AZURE_OPENAI_API_KEY")
                );
var kernel = builder.Build();

kernel.Plugins.Add(KernelPluginFactory.CreateFromType<MenuPlugin>());

ChatCompletionAgent agent =
    new()
    {
        Name = "SK-Assistant",
        Instructions = "You are a helpful assistant.",
        Kernel = kernel,
        Arguments = new KernelArguments(new PromptExecutionSettings() { FunctionChoiceBehavior = FunctionChoiceBehavior.Auto() })

    };

await foreach (AgentResponseItem<ChatMessageContent> response 
    in agent.InvokeAsync("What is the price of the soup special?"))
{
    Console.WriteLine(response.Message);
}

sealed class MenuPlugin
{
    [KernelFunction, Description("Provides a list of specials from the menu.")]
    public string GetSpecials() =>
        """
        Special Soup: Clam Chowder
        Special Salad: Cobb Salad
        Special Drink: Chai Tea
        """;

    [KernelFunction, Description("Provides the price of the requested menu item.")]
    public string GetItemPrice(
        [Description("The name of the menu item.")]
        string menuItem) =>
        "$9.99";
}

Multi-Agent System - Python

Build a system of specialized agents that can collaborate:

import asyncio
from semantic_kernel.agents import ChatCompletionAgent, ChatHistoryAgentThread
from semantic_kernel.connectors.ai.open_ai import AzureChatCompletion, OpenAIChatCompletion

billing_agent = ChatCompletionAgent(
    service=AzureChatCompletion(), 
    name="BillingAgent", 
    instructions="You handle billing issues like charges, payment methods, cycles, fees, discrepancies, and payment failures."
)

refund_agent = ChatCompletionAgent(
    service=AzureChatCompletion(),
    name="RefundAgent",
    instructions="Assist users with refund inquiries, including eligibility, policies, processing, and status updates.",
)

triage_agent = ChatCompletionAgent(
    service=OpenAIChatCompletion(),
    name="TriageAgent",
    instructions="Evaluate user requests and forward them to BillingAgent or RefundAgent for targeted assistance."
    " Provide the full answer to the user containing any information from the agents",
    plugins=[billing_agent, refund_agent],
)

thread: ChatHistoryAgentThread = None

async def main() -> None:
    print("Welcome to the chat bot!\n  Type 'exit' to exit.\n  Try to get some billing or refund help.")
    while True:
        user_input = input("User:> ")

        if user_input.lower().strip() == "exit":
            print("\n\nExiting chat...")
            return False

        response = await triage_agent.get_response(
            messages=user_input,
            thread=thread,
        )

        if response:
            print(f"Agent :> {response}")

# Agent :> I understand that you were charged twice for your subscription last month, and I'm here to assist you with resolving this issue. Here’s what we need to do next:

# 1. **Billing Inquiry**:
#    - Please provide the email address or account number associated with your subscription, the date(s) of the charges, and the amount charged. This will allow the billing team to investigate the discrepancy in the charges.

# 2. **Refund Process**:
#    - For the refund, please confirm your subscription type and the email address associated with your account.
#    - Provide the dates and transaction IDs for the charges you believe were duplicated.

# Once we have these details, we will be able to:

# - Check your billing history for any discrepancies.
# - Confirm any duplicate charges.
# - Initiate a refund for the duplicate payment if it qualifies. The refund process usually takes 5-10 business days after approval.

# Please provide the necessary details so we can proceed with resolving this issue for you.


if __name__ == "__main__":
    asyncio.run(main())

Where to Go Next

  1. 📖 Try our Getting Started Guide or learn about Building Agents
  2. 🔌 Explore over 100 Detailed Samples
  3. 💡 Learn about core Semantic Kernel Concepts

API References

Troubleshooting

Common Issues

  • Authentication Errors: Check that your API key environment variables are correctly set
  • Model Availability: Verify your Azure OpenAI deployment or OpenAI model access

Getting Help

  • Check our GitHub issues for known problems
  • Search the Discord community for solutions
  • Include your SDK version and full error messages when asking for help

Join the community

We welcome your contributions and suggestions to the SK community! One of the easiest ways to participate is to engage in discussions in the GitHub repository. Bug reports and fixes are welcome!

For new features, components, or extensions, please open an issue and discuss with us before sending a PR. This is to avoid rejection as we might be taking the core in a different direction, but also to consider the impact on the larger ecosystem.

To learn more and get started:

Contributor Wall of Fame

semantic-kernel contributors

Code of Conduct

This project has adopted the Microsoft Open Source Code of Conduct. For more information, see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

License

Copyright (c) Microsoft Corporation. All rights reserved.

Licensed under the MIT license.

S
Description
Integrate cutting-edge LLM technology quickly and easily into your apps
Readme MIT
482 MiB
Languages
C# 62.1%
Python 35.7%
Jupyter Notebook 1.6%
TypeScript 0.3%