Copilotandrogerbarreto fb10d92d8c .Net: Bump Snappier to 1.3.1 to fix NU1903 high-severity vulnerability (GHSA-pggp-6c3x-2xmx) (#13960)
### Motivation and Context

`MongoDB.Driver 3.5.2` transitively introduces `Snappier 1.0.0`, which
carries a high-severity vulnerability (GHSA-pggp-6c3x-2xmx): infinite
loop during SnappyStream decompression of malformed framed input. All
Snappier versions ≤ 1.3.0 are affected; 1.3.1 is the first patched
release. This was blocking the merge queue via NU1903.

### Description

- **`dotnet/Directory.Packages.props`** — Add `PackageVersion` entry
pinning `Snappier` to `1.3.1`.
- **`dotnet/src/VectorData/MongoDB/MongoDB.csproj`** — Add explicit
`PackageReference` for `Snappier` (versionless, resolved via CPM) so
NuGet treats it as a direct dependency at 1.3.1, overriding the
transitive 1.0.0 from `MongoDB.Driver`.
- **`dotnet/src/VectorData/CosmosMongoDB/CosmosMongoDB.csproj`** — Same
override for the CosmosMongoDB connector.

In NuGet's resolution algorithm, a direct reference at depth 1 wins over
a transitive reference at depth 2, so this cleanly forces 1.3.1 without
changing the `MongoDB.Driver` pin itself.

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄

<!-- START COPILOT ORIGINAL PROMPT -->



<details>

<summary>Original prompt</summary>

Please investigate a solution to snappier vulnerability fix (update
version) and propose a PR with the bump, ideally following the first
immediate a non breaking version bump

<analysis>
**Chronological Review:**
1. User asked to analyze PR #13431 (Gemini multimodal tool results in
microsoft/semantic-kernel) for gaps
2. Initial analysis identified ~11 gaps with broad scope including
OpenAI Assistants, AzureAI, Responses API, MistralAI
3. User invoked ouroboros skill, asked to reassess scoping to Google
package only
4. Reassessment: Google connector bypasses FunctionCallsProcessor; only
validated regression is OpenAI Responses API
5. User invoked ouroboros to seed the observation; created seed file
`pr-13431-followup.seed.yaml`
6. User asked to execute seed + identify pipeline error
7. Implemented 5 file changes; identified pipeline error CS8602 in
GeminiRequestTests.cs:809
8. All builds/tests passed; user asked about string→object impact in
plan mode
9. Investigation revealed `FunctionCallsProcessor` is `internal sealed`,
source-distributed, so blast radius small
10. User confirmed all implemented; ran CI-parity dotnet format via
WSL2+Docker (all pass)
11. User asked to commit and push - committed `de08bce99` and pushed to
Cozmopolit fork
12. User asked to check PR comments - found 2 Copilot bot review
comments
13. User said: add OpenAI test (item 1), reply out-of-scope (item 2)
14. Added OpenAI ChatCompletion test, committed `e9f27d21a`, pushed,
replied to both bot comments
15. User asked PR number (13431)
16. User invoked /auto pr_task - PR was green, no action needed
17. User said merge queue failed, asked to investigate
18. Investigation found: NU1903 Snappier 1.0.0 vulnerability blocking
merge queue; not caused by our PR
19. **Most recent: User asked "Do we have a fix in main for this
already?"**
20. **Investigation confirmed: NO fix in main** - origin/main HEAD
`1a5065e5c` unchanged, `MongoDB.Driver 3.5.2` still pinned, no Snappier
override, no PRs/issues for Snappier or NU1903 in the repo recently
21. **Offered to open a small fix PR pinning Snappier to a patched
version**

**Intent Mapping:**
- User wants PR #13431 fully landed
- User wants to understand whether merge queue failure is in scope
- User now considering whether to fix the Snappier vulnerability
separately

**Technical Inventory:**
- .NET 10.0, semantic-kernel repo
- WSL2 + Docker (mcr.microsoft.com/dotnet/sdk:10.0) for CI parity
- gh CLI for PR/CI operations
- Git remotes: origin=microsoft, roger=rogerbarreto fork,
cozmopolit=Cozmopolit fork (added)
- Branch: `fix/multimodal-tool-results`
- PR head fork: Cozmopolit, maintainerCanModify=true

**Code Archaeology:**
Files changed in commits `de08bce99` + `e9f27d21a`:
- `dotnet/src/Agents/OpenAI/Internal/ResponseThreadActions.cs` — added
GetFunctionResultAsString helper
-
`dotnet/src/Agents/UnitTests/OpenAI/Internal/ResponseThreadActionsTests.cs`
— new (3 tests)
-
`dotnet/src/Connectors/Connectors.Google/Core/Gemini/Models/GeminiRequest.cs`
— extracted s_imageFunctionResponseEnvelope
-
`dotnet/src/Connectors/Connectors.Google.UnitTests/Core/Gemini/GeminiRequestTests.cs`
— CS8602 fix
-
`dotnet/src/InternalUtilities/connectors/AI/FunctionCalling/FunctionCallsProcessor.cs`
— XML-doc tightening
-
`dotnet/src/Connectors/Connectors.OpenAI.UnitTests/Services/OpenAIChatCompletionServiceTests.cs`
— added
ItSendsImageContentNotSupportedErrorWhenToolResultIsImageContentAsync

Identified vulnerable package: `MongoDB.Driver 3.5.2` in
`dotnet/Directory.Packages.props:173` brings in transitive `Snappier
1.0.0`

**Progress Assessment:**
- ✅ All planned implementation completed
- ✅ Both bot review comments replied to
- ✅ All 7 todos done
- ⚠️ PR cannot merge due to environmental Snappier vulnerability (not
our PR's fault)
- 🔲 User considering whether to open a separate Snappier fix PR

**Context Validation:**
- PR state: OPEN, MERGEABLE, CLEAN, APPROVED (markwallace-microsoft)
- HEAD SHA: `e9f27d21a85a8b97ee5f29619b23b82a03e313ff`
- All required CI checks pass on PR head
- Merge queue attempt failed at 2026-05-07T10:01:31, removed by
github-merge-queue[bot] at 10:08:05
- Failed merge_group run: 25489152862

**Recent Commands Analysis:**
Most recent two tool batches:
1. `git fetch origin main; git log origin/main
--since="2026-05-06T15:00:00Z" --oneline` → only `1a5065e5c`
(yesterday's commit)
2. `git show origin/main:dotnet/Directory.Packages.props | grep
Snappier|MongoDB.Driver` → only `MongoDB.Driver 3.5.2`, no Snappier
override
3. `gh search prs/issues --state all "Snappier"` → command failed
(invalid `all` state)
4. `gh api search/issues?q=Snappier+repo:microsoft/semantic-kernel` →
empty results
5. `gh api search/issues?q=NU1903+repo:microsoft/semantic-kernel` → 3
historical results from 2024, all unrelated

Final response: confirmed NO fix in main, offered to open a small fix PR
pinning Snappier.
</analysis>

<summary>
1. Conversation Overview:
   - Primary Objectives:
     - Analyze SK PR #13431 (G...

</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

Created from Copilot CLI via the copilot delegate command.

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: rogerbarreto <[email protected]>
2026-05-07 12:56:07 +00:00
2023-09-04 19:55:35 +00:00
2023-02-24 16:38:23 -08:00

Semantic Kernel

Important

Semantic Kernel is now Microsoft Agent Framework! Microsoft Agent Framework (MAF) is the enterprise‑ready successor to Semantic Kernel. Microsoft Agent Framework is now available at version 1.0 as a production-ready release: stable APIs, and a commitment to long-term support. Whether you're building a single assistant or orchestrating a fleet of specialized agents, Microsoft Agent Framework 1.0 gives you enterprise-grade multi-agent orchestration, multi-provider model support, and cross-runtime interoperability via A2A and MCP.

Learn more about Semantic Kernel and Agent Framework here: Semantic Kernel and Microsoft Agent Framework on the Agent Framework blog, and try out the Semantic Kernel migration guide.

Build intelligent AI agents and multi-agent systems with this enterprise-ready orchestration framework

License: MIT Python package Nuget package Discord

What is Semantic Kernel?

Semantic Kernel is a model-agnostic SDK that empowers developers to build, orchestrate, and deploy AI agents and multi-agent systems. Whether you're building a simple chatbot or a complex multi-agent workflow, Semantic Kernel provides the tools you need with enterprise-grade reliability and flexibility.

System Requirements

  • Python: 3.10+
  • .NET: .NET 10.0+
  • Java: JDK 17+
  • OS Support: Windows, macOS, Linux

Key Features

  • Model Flexibility: Connect to any LLM with built-in support for OpenAI, Azure OpenAI, Hugging Face, NVidia and more
  • Agent Framework: Build modular AI agents with access to tools/plugins, memory, and planning capabilities
  • Multi-Agent Systems: Orchestrate complex workflows with collaborating specialist agents
  • Plugin Ecosystem: Extend with native code functions, prompt templates, OpenAPI specs, or Model Context Protocol (MCP)
  • Vector DB Support: Seamless integration with Azure AI Search, Elasticsearch, Chroma, and more
  • Multimodal Support: Process text, vision, and audio inputs
  • Local Deployment: Run with Ollama, LMStudio, or ONNX
  • Process Framework: Model complex business processes with a structured workflow approach
  • Enterprise Ready: Built for observability, security, and stable APIs

Installation

First, set the environment variable for your AI Services:

Azure OpenAI:

export AZURE_OPENAI_API_KEY=AAA....

or OpenAI directly:

export OPENAI_API_KEY=sk-...

Python

pip install semantic-kernel

.NET

dotnet add package Microsoft.SemanticKernel
dotnet add package Microsoft.SemanticKernel.Agents.Core

Java

See semantic-kernel-java build for instructions.

Quickstart

Basic Agent - Python

Create a simple assistant that responds to user prompts:

import asyncio
from semantic_kernel.agents import ChatCompletionAgent
from semantic_kernel.connectors.ai.open_ai import AzureChatCompletion

async def main():
    # Initialize a chat agent with basic instructions
    agent = ChatCompletionAgent(
        service=AzureChatCompletion(),
        name="SK-Assistant",
        instructions="You are a helpful assistant.",
    )

    # Get a response to a user message
    response = await agent.get_response(messages="Write a haiku about Semantic Kernel.")
    print(response.content)

asyncio.run(main()) 

# Output:
# Language's essence,
# Semantic threads intertwine,
# Meaning's core revealed.

Basic Agent - .NET

using Microsoft.SemanticKernel;
using Microsoft.SemanticKernel.Agents;

var builder = Kernel.CreateBuilder();
builder.AddAzureOpenAIChatCompletion(
                Environment.GetEnvironmentVariable("AZURE_OPENAI_DEPLOYMENT"),
                Environment.GetEnvironmentVariable("AZURE_OPENAI_ENDPOINT"),
                Environment.GetEnvironmentVariable("AZURE_OPENAI_API_KEY")
                );
var kernel = builder.Build();

ChatCompletionAgent agent =
    new()
    {
        Name = "SK-Agent",
        Instructions = "You are a helpful assistant.",
        Kernel = kernel,
    };

await foreach (AgentResponseItem<ChatMessageContent> response 
    in agent.InvokeAsync("Write a haiku about Semantic Kernel."))
{
    Console.WriteLine(response.Message);
}

// Output:
// Language's essence,
// Semantic threads intertwine,
// Meaning's core revealed.

Agent with Plugins - Python

Enhance your agent with custom tools (plugins) and structured output:

import asyncio
from typing import Annotated
from pydantic import BaseModel
from semantic_kernel.agents import ChatCompletionAgent
from semantic_kernel.connectors.ai.open_ai import AzureChatCompletion, OpenAIChatPromptExecutionSettings
from semantic_kernel.functions import kernel_function, KernelArguments

class MenuPlugin:
    @kernel_function(description="Provides a list of specials from the menu.")
    def get_specials(self) -> Annotated[str, "Returns the specials from the menu."]:
        return """
        Special Soup: Clam Chowder
        Special Salad: Cobb Salad
        Special Drink: Chai Tea
        """

    @kernel_function(description="Provides the price of the requested menu item.")
    def get_item_price(
        self, menu_item: Annotated[str, "The name of the menu item."]
    ) -> Annotated[str, "Returns the price of the menu item."]:
        return "$9.99"

class MenuItem(BaseModel):
    price: float
    name: str

async def main():
    # Configure structured output format
    settings = OpenAIChatPromptExecutionSettings()
    settings.response_format = MenuItem

    # Create agent with plugin and settings
    agent = ChatCompletionAgent(
        service=AzureChatCompletion(),
        name="SK-Assistant",
        instructions="You are a helpful assistant.",
        plugins=[MenuPlugin()],
        arguments=KernelArguments(settings)
    )

    response = await agent.get_response(messages="What is the price of the soup special?")
    print(response.content)

    # Output:
    # The price of the Clam Chowder, which is the soup special, is $9.99.

asyncio.run(main()) 

Agent with Plugin - .NET

using System.ComponentModel;
using Microsoft.SemanticKernel;
using Microsoft.SemanticKernel.Agents;
using Microsoft.SemanticKernel.ChatCompletion;

var builder = Kernel.CreateBuilder();
builder.AddAzureOpenAIChatCompletion(
                Environment.GetEnvironmentVariable("AZURE_OPENAI_DEPLOYMENT"),
                Environment.GetEnvironmentVariable("AZURE_OPENAI_ENDPOINT"),
                Environment.GetEnvironmentVariable("AZURE_OPENAI_API_KEY")
                );
var kernel = builder.Build();

kernel.Plugins.Add(KernelPluginFactory.CreateFromType<MenuPlugin>());

ChatCompletionAgent agent =
    new()
    {
        Name = "SK-Assistant",
        Instructions = "You are a helpful assistant.",
        Kernel = kernel,
        Arguments = new KernelArguments(new PromptExecutionSettings() { FunctionChoiceBehavior = FunctionChoiceBehavior.Auto() })

    };

await foreach (AgentResponseItem<ChatMessageContent> response 
    in agent.InvokeAsync("What is the price of the soup special?"))
{
    Console.WriteLine(response.Message);
}

sealed class MenuPlugin
{
    [KernelFunction, Description("Provides a list of specials from the menu.")]
    public string GetSpecials() =>
        """
        Special Soup: Clam Chowder
        Special Salad: Cobb Salad
        Special Drink: Chai Tea
        """;

    [KernelFunction, Description("Provides the price of the requested menu item.")]
    public string GetItemPrice(
        [Description("The name of the menu item.")]
        string menuItem) =>
        "$9.99";
}

Multi-Agent System - Python

Build a system of specialized agents that can collaborate:

import asyncio
from semantic_kernel.agents import ChatCompletionAgent, ChatHistoryAgentThread
from semantic_kernel.connectors.ai.open_ai import AzureChatCompletion, OpenAIChatCompletion

billing_agent = ChatCompletionAgent(
    service=AzureChatCompletion(), 
    name="BillingAgent", 
    instructions="You handle billing issues like charges, payment methods, cycles, fees, discrepancies, and payment failures."
)

refund_agent = ChatCompletionAgent(
    service=AzureChatCompletion(),
    name="RefundAgent",
    instructions="Assist users with refund inquiries, including eligibility, policies, processing, and status updates.",
)

triage_agent = ChatCompletionAgent(
    service=OpenAIChatCompletion(),
    name="TriageAgent",
    instructions="Evaluate user requests and forward them to BillingAgent or RefundAgent for targeted assistance."
    " Provide the full answer to the user containing any information from the agents",
    plugins=[billing_agent, refund_agent],
)

thread: ChatHistoryAgentThread = None

async def main() -> None:
    print("Welcome to the chat bot!\n  Type 'exit' to exit.\n  Try to get some billing or refund help.")
    while True:
        user_input = input("User:> ")

        if user_input.lower().strip() == "exit":
            print("\n\nExiting chat...")
            return False

        response = await triage_agent.get_response(
            messages=user_input,
            thread=thread,
        )

        if response:
            print(f"Agent :> {response}")

# Agent :> I understand that you were charged twice for your subscription last month, and I'm here to assist you with resolving this issue. Here’s what we need to do next:

# 1. **Billing Inquiry**:
#    - Please provide the email address or account number associated with your subscription, the date(s) of the charges, and the amount charged. This will allow the billing team to investigate the discrepancy in the charges.

# 2. **Refund Process**:
#    - For the refund, please confirm your subscription type and the email address associated with your account.
#    - Provide the dates and transaction IDs for the charges you believe were duplicated.

# Once we have these details, we will be able to:

# - Check your billing history for any discrepancies.
# - Confirm any duplicate charges.
# - Initiate a refund for the duplicate payment if it qualifies. The refund process usually takes 5-10 business days after approval.

# Please provide the necessary details so we can proceed with resolving this issue for you.


if __name__ == "__main__":
    asyncio.run(main())

Where to Go Next

  1. 📖 Try our Getting Started Guide or learn about Building Agents
  2. 🔌 Explore over 100 Detailed Samples
  3. 💡 Learn about core Semantic Kernel Concepts

API References

Troubleshooting

Common Issues

  • Authentication Errors: Check that your API key environment variables are correctly set
  • Model Availability: Verify your Azure OpenAI deployment or OpenAI model access

Getting Help

  • Check our GitHub issues for known problems
  • Search the Discord community for solutions
  • Include your SDK version and full error messages when asking for help

Join the community

We welcome your contributions and suggestions to the SK community! One of the easiest ways to participate is to engage in discussions in the GitHub repository. Bug reports and fixes are welcome!

For new features, components, or extensions, please open an issue and discuss with us before sending a PR. This is to avoid rejection as we might be taking the core in a different direction, but also to consider the impact on the larger ecosystem.

To learn more and get started:

Contributor Wall of Fame

semantic-kernel contributors

Code of Conduct

This project has adopted the Microsoft Open Source Code of Conduct. For more information, see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

License

Copyright (c) Microsoft Corporation. All rights reserved.

Licensed under the MIT license.

S
Description
Integrate cutting-edge LLM technology quickly and easily into your apps
Readme MIT
482 MiB
Languages
C# 62.1%
Python 35.7%
Jupyter Notebook 1.6%
TypeScript 0.3%