Python: Restrict persisted checkpoint deserialization by default#4941
Merged
Conversation
Add RestrictedUnpickler to _checkpoint_encoding.py that limits which types may be instantiated during pickle deserialization. By default FileCheckpointStorage now uses the restricted unpickler, allowing only: - Built-in Python value types (primitives, datetime, uuid, decimal, collections, etc.) - All agent_framework.* internal types - Additional types specified via the new allowed_checkpoint_types parameter on FileCheckpointStorage This narrows the default type surface area for persisted checkpoints while keeping framework-owned scenarios working without extra configuration. Developers can extend the allowed set by passing "module:qualname" strings to allowed_checkpoint_types. The decode_checkpoint_value function retains backward-compatible unrestricted behavior when called without the new allowed_types kwarg. Fixes microsoft#4894 Co-authored-by: Copilot <[email protected]>
Add explicit type annotation for super().find_class() return value to satisfy mypy's no-any-return check. Fixes microsoft#4894 Co-authored-by: Copilot <[email protected]>
moonbox3
commented
Mar 27, 2026
moonbox3
left a comment
Contributor
Author
There was a problem hiding this comment.
Automated Code Review
Reviewers: 4 | Confidence: 92%
✓ Correctness
This PR contains only cosmetic and linting changes: reformatting indentation in test files, collapsing a multi-line call onto one line, adding a
# noqa: S301comment to suppress a Bandit pickle warning on the restricted unpickler, splitting a return into annotated local variable + return (likely to satisfy a linter), replacing try/except with contextlib.suppress, and removing an unused import. All changes are semantically equivalent to the original code with no behavioral differences.
✓ Security Reliability
This PR contains purely cosmetic changes: a
# noqa: S301suppression on the restricted unpickler class (appropriate since the class intentionally subclasses pickle.Unpickler to add safety restrictions), a local variable assignment infind_classfor type annotation, indentation fixes in tests, replacing try/except with contextlib.suppress, and removing an unused import. No security-relevant behavior is changed. The existing restricted unpickler design, allowlist logic, and fallback to unrestricted pickle whenallowed_types is Noneare all unchanged.
✓ Test Coverage
This PR is purely formatting, linting, and style cleanup with no behavioral changes. Production code changes are: (1) a
# noqa: S301comment to suppress Bandit's pickle warning, (2) an intermediate typed variable before returning infind_class, and (3) a single-line reformatting of a function call. Test changes are: removing an unused import (_BUILTIN_ALLOWED_TYPE_KEYS), replacing atry/except: passwithcontextlib.suppress, and fixing indentation. Since no behavior changed, no new tests are needed and the existing test suite adequately covers the restricted unpickler logic including blocked callables, blocked__reduce__payloads, code execution prevention, user-type allow/block, built-in safe types, and file-based checkpoint round-trips.
✓ Design Approach
This PR makes four types of changes: (1) reformats a long function call in _checkpoint.py, (2) adds a
# noqa: S301suppression to the_RestrictedUnpicklerclass definition and splits areturninto an intermediate typed variable, (3) replacestry/except Exception: passwithcontextlib.suppress(Exception)in a security test, and (4) fixes indentation in test files. None of these represent fundamentally misguided design approaches. The# noqa: S301on the class definition is appropriate—the file already uses the same pattern forpickle.loadsand the import itself. Thecontextlib.suppress(Exception)change is semantically equivalent to the original. The one minor concern is the intermediateresult: type = super().find_class(module, name); return resultpattern, which appears to work around a linter warning in an indirect way rather than either (a) placing a targeted# noqaon the return line or (b) simply keeping the direct return. The type annotationresult: typeis also imprecise sincepickle.Unpickler.find_classhas a broader return type in most stubs, though this has no runtime impact. No blocking design issues exist.
Suggestions
- The intermediate variable
result: type = super().find_class(module, name); return resultin_RestrictedUnpickler.find_classappears to be a workaround for a linter warning. It is clearer to keep the directreturn super().find_class(module, name) # noqa: S301 # nosecform, which is already the established pattern used on thepickle.loadscall in the same file. The current split adds indirection without improving readability or type safety.
Automated review by moonbox3's agents
Contributor
Python Test Coverage Report •
Python Unit Test Overview
|
|||||||||||||||||||||||||||||||||||
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens Python workflow checkpoint persistence by introducing restricted pickle deserialization for file-based checkpoints, addressing typing/lint issues, and updating/adding tests to cover the new allow-list behavior (Fixes #4894).
Changes:
- Added a restricted unpickler and a built-in allow-list for checkpoint deserialization, with an extension mechanism via allow-listed
"module:qualname"strings. - Updated
FileCheckpointStorageto acceptallowed_checkpoint_typesand to use restricted deserialization by default. - Updated existing workflow checkpoint tests and added new tests validating restricted vs. unrestricted decoding behavior.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| python/packages/core/agent_framework/_workflows/_checkpoint_encoding.py | Adds restricted unpickling path + allow-list and threads restriction through decode helpers. |
| python/packages/core/agent_framework/_workflows/_checkpoint.py | Adds allowed_checkpoint_types option and applies restricted decoding on load/list. |
| python/packages/core/tests/workflow/test_request_info_event_rehydrate.py | Updates file-based checkpoint tests to pass required allowed types. |
| python/packages/core/tests/workflow/test_checkpoint.py | Updates file-based checkpoint roundtrip tests to pass required allowed types for custom objects. |
| python/packages/core/tests/workflow/test_checkpoint_unrestricted_pickle.py | New tests validating restricted decoding blocks unsafe payloads and allow-list behavior. |
Remove unnecessary intermediate variable and apply # noqa: S301 # nosec directly on the super().find_class() call, matching the established pattern used on the pickle.loads() call in the same file. Co-authored-by: Copilot <[email protected]>
…ckpoint persistence defaults
moonbox3
commented
Mar 27, 2026
moonbox3
left a comment
Contributor
Author
There was a problem hiding this comment.
Automated Code Review
Reviewers: 4 | Confidence: 93%
✓ Correctness
This is a trivial comment-only change that swaps a ruff/flake8-bandit lint suppression (
# noqa: S301) for a mypy type suppression (# type: ignore[no-any-return]) on thesuper().find_class()call. The# nosecbandit suppression is correctly retained. The type ignore is appropriate becausepickle.Unpickler.find_classis typed as returningAnyin typeshed, while this override declares atypereturn. The class-level# noqa: S301on line 82 already covers the S301 rule for this class, so removing it from line 102 should not introduce new lint warnings. No behavioral change whatsoever.
✓ Security Reliability
This change swaps a ruff/flake8 suppression comment (
# noqa: S301) for a mypy suppression comment (# type: ignore[no-any-return]) on thesuper().find_class()call in_RestrictedUnpickler. The# nosecbandit suppression is retained. No runtime behavior is altered — this is purely a static-analysis annotation change. The existing security controls (allowlist-basedfind_class,_BUILTIN_ALLOWED_TYPE_KEYS, framework module prefix check) remain intact and are sound for their stated purpose.
✓ Test Coverage
This is a purely cosmetic change: replacing a Ruff/flake8
# noqa: S301suppression comment with a mypy# type: ignore[no-any-return]on thefind_classreturn in_RestrictedUnpickler. No runtime behavior is altered. The existing test suite intest_checkpoint_decode.pyandtest_checkpoint_unrestricted_pickle.pycomprehensively covers thefind_classcode path — including allowed built-in types, framework types, explicitly allowed user types, blocked arbitrary callables, blocked__reduce__payloads, and code-execution prevention. No new behavior was introduced, so no additional tests are needed.
✗ Design Approach
The change correctly adds
# type: ignore[no-any-return]to silence a mypy complaint aboutpickle.Unpickler.find_classbeing typed asAnyin typeshed while the override declares-> type. However, it removes the# noqa: S301suppression that was previously on the same line. Since the project runs ruff with the"S"(bandit) rule set enabled and ruff respects# noqa(not# nosec), dropping# noqa: S301will likely produce a ruff S301 lint failure on this line. The# nosecretained here only suppresses direct bandit runs, not ruff's bandit rules. The other two pickle-related lines in the same file (line 82, line 246) still carry# noqa: S301, making this removal inconsistent.
Flagged Issues
- Removing
# noqa: S301from line 102 will cause a ruff S301 lint failure. The project has"S"rules enabled in ruff (pyproject.tomlselect), and ruff uses# noqasyntax—not# nosec—to suppress those violations. Lines 82 and 246 in the same file still carry# noqa: S301; line 102 should too.
Suggestions
- Removing
# noqa: S301means ruff/flake8 (with theSplugin) will now flag this line with S301 (use ofpickle). Verify that your CI linting configuration either doesn't enable theSruleset for this file or that the project-level config already suppresses S301 globally, otherwise this will become a lint failure.
Automated review by moonbox3's agents
…t#4894) The review feedback correctly identified that removing the # noqa: S301 suppression from the find_class return statement would cause a ruff S301 lint failure, since the project enables bandit ("S") rules. This restores consistency with lines 82 and 246 in the same file. Co-authored-by: Copilot <[email protected]>
…ckpoint persistence defaults
moonbox3
commented
Mar 27, 2026
moonbox3
left a comment
Contributor
Author
There was a problem hiding this comment.
Automated Code Review
Reviewers: 4 | Confidence: 94%
✓ Correctness
This is a trivial cleanup removing a redundant
# noqa: S301comment from line 102. The class-level suppression on line 82 already covers the S301 (pickle usage) diagnostic for the entire class, and the# noseccomment (Bandit) remains in place on line 102. No correctness concerns.
✓ Security Reliability
This is a cosmetic-only change that removes a redundant
# noqa: S301(ruff/flake8 suppression) from a line that already carries# nosec(Bandit suppression). The underlyingsuper().find_class(module, name)call and all surrounding security logic — the restricted unpickler allowlist, the framework-module prefix check, and the type-verification step — are completely unchanged. No security or reliability concerns are introduced.
✓ Test Coverage
This PR removes a redundant
# noqa: S301lint suppression comment from a line that already carries# nosec(bandit's own suppression directive). The change is purely cosmetic — no logic, no behavior, and no API surface is altered. There is no test coverage implication because no runtime behavior changed. Existing tests in test_checkpoint_encode.py, test_checkpoint_decode.py, and test_checkpoint_unrestricted_pickle.py already cover the _RestrictedUnpickler.find_class path, and no new tests are needed for a comment removal.
✓ Design Approach
The diff removes a
# noqa: S301suppression comment from a line that already carries# nosec. Thenoqa: S301suppression is for Bandit's 'pickle usage' warning as surfaced through flake8-bugbear or similar linters;# noseccovers Bandit's direct scan. Sincesuper().find_class()in a restricted unpickler is intentional and controlled, the# nosecannotation is the correct Bandit suppression mechanism. Removing the redundant# noqa: S301is a minor cleanup with no functional impact. There are no design or correctness concerns in this change.
Suggestions
- Confirm that the CI linter pipeline does not flag S301 via a noqa-based tool (e.g., flake8 or ruff) independently of Bandit's nosec mechanism. If so, removing
# noqa: S301could reintroduce a lint failure.
Automated review by moonbox3's agents
- Move module docstring to proper position after __future__ import - Fix find_class return type annotation to type[Any] - Add missing # noqa: S301 pragma on find_class return - Improve error message to reference both allowed_types param and FileCheckpointStorage.allowed_checkpoint_types - Add -> None return annotation to FileCheckpointStorage.__init__ - Replace tempfile.mktemp with TemporaryDirectory in test - Replace contextlib.suppress with pytest.raises for precise assertion - Remove unused contextlib import Co-authored-by: Copilot <[email protected]>
… return type - Move module docstring before 'from __future__' import so it populates __doc__ (comment #4) - Change find_class return annotation from type[Any] to type to avoid misleading callers about non-type returns like copyreg._reconstructor (comment #2) Comments #1, #3, #5, #6, #7, #8 were already addressed in the current code. Co-authored-by: Copilot <[email protected]>
…cstring (microsoft#4894) - Change _RestrictedUnpickler.find_class to raise pickle.UnpicklingError instead of WorkflowCheckpointException, since it is pickle-level concern that gets wrapped by the caller in _base64_to_unpickle. - Remove now-unnecessary WorkflowCheckpointException re-raise in _base64_to_unpickle (pickle.UnpicklingError is caught by the generic except Exception handler and wrapped). - Expand decode_checkpoint_value docstring to show a concrete example of the module:qualname format with a user-defined class. - Add regression test verifying find_class raises pickle.UnpicklingError. Co-authored-by: Copilot <[email protected]>
- Comment 1 (line 103): Already resolved in prior commit — _RestrictedUnpickler now raises pickle.UnpicklingError instead of WorkflowCheckpointException. - Comment 2 (line 140): Add concrete usage examples to decode_checkpoint_value docstring showing both direct allowed_types usage and FileCheckpointStorage allowed_checkpoint_types usage. Rename 'SafeState' to 'MyState' across all docstrings for consistency, making it clear this is a user-defined class name. Co-authored-by: Copilot <[email protected]>
This was referenced May 10, 2026
Closed
This was referenced May 18, 2026
This was referenced May 26, 2026
sanaullahmohammed
pushed a commit
to sanaullahmohammed/NexusOps
that referenced
this pull request
May 28, 2026
Updated [Microsoft.Agents.AI](https://github.com/microsoft/agent-framework) from 1.0.0 to 1.8.0. <details> <summary>Release notes</summary> _Sourced from [Microsoft.Agents.AI's releases](https://github.com/microsoft/agent-framework/releases)._ ## 1.7.0 ## [1.7.0] - 2026-05-28 ### Added - **agent-framework-core**: Add `HarnessAgent` and background-agents harness provider ([#6041](https://github.com/microsoft/agent-framework/pull/6041), [#6069](https://github.com/microsoft/agent-framework/pull/6069)) - **agent-framework-core**, **agent-framework-a2a**: Add `A2AAgentSession` with referenced task IDs and input-required support ([#5980](https://github.com/microsoft/agent-framework/pull/5980)) - **agent-framework-foundry**: Add experimental prompt-agent conversion and deployment APIs ([#5959](https://github.com/microsoft/agent-framework/pull/5959)) - **agent-framework-declarative**: Add Foundry Toolbox MCP invocation support and sample ([#5933](https://github.com/microsoft/agent-framework/pull/5933)) - **samples**: Add hosting samples overview README ([#5407](https://github.com/microsoft/agent-framework/pull/5407)) ### Changed - **agent-framework-core**: Align TodoProvider tool names with the C# implementation ([#6107](https://github.com/microsoft/agent-framework/pull/6107)) - **agent-framework-core**: Align ModeProvider tool names and instructions ([#6071](https://github.com/microsoft/agent-framework/pull/6071)) - **agent-framework-chatkit**: Raise the `openai-chatkit` dependency floor to `>=1.6.4` to match the current typed API usage. - **agent-framework-declarative**: [BREAKING] Remove Python-only declarative actions and rename alias kinds to C# canonical names ([#6126](https://github.com/microsoft/agent-framework/pull/6126)) - **tests**: Replace deprecated `asyncio.iscoroutinefunction` usage in DevUI cleanup-hook tests ([#4563](https://github.com/microsoft/agent-framework/pull/4563)) ### Fixed - **agent-framework-core**: Point `@experimental` warnings at user code ([#5996](https://github.com/microsoft/agent-framework/pull/5996)) - **agent-framework-declarative**: Fix Foreach body exit wiring ([#6050](https://github.com/microsoft/agent-framework/pull/6050)) - **agent-framework-devui**: Fix streaming memory growth regression ([#6038](https://github.com/microsoft/agent-framework/pull/6038)) - **agent-framework-foundry**: Pass default headers to Foundry agents ([#6040](https://github.com/microsoft/agent-framework/pull/6040)) - **agent-framework-foundry-hosting**: Fix hosted handoff argument serialization ([#5861](https://github.com/microsoft/agent-framework/pull/5861)) - **agent-framework-foundry-hosting**: Allow hosted checkpoints to restore `MessageRole` values ([#6049](https://github.com/microsoft/agent-framework/pull/6049)) - **agent-framework-openai**: Preserve citation `get_url` metadata ([#6037](https://github.com/microsoft/agent-framework/pull/6037)) - **agent-framework-openai**: Guard Chat Completions streaming against null deltas ([#5734](https://github.com/microsoft/agent-framework/pull/5734)) - **agent-framework-openai**: Read response headers defensively for stream wrappers without `.headers` ([#6028](https://github.com/microsoft/agent-framework/pull/6028), [#6029](https://github.com/microsoft/agent-framework/pull/6029)) - **samples**: Fix sequential workflow sample output handling ([#5976](https://github.com/microsoft/agent-framework/pull/5976)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.6.0...python-1.7.0 ## 1.6.1 ## What's Changed * .NET: Add hyperlight to release slnf by @westey-m in https://github.com/microsoft/agent-framework/pull/5695 * .NET: Update FoundryAgent to address HostedAgents strict URL routing by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5677 * .NET: Add IChatMessageInjector for message injection during function loop by @westey-m in https://github.com/microsoft/agent-framework/pull/5679 * .NET: Foundry.Hosting IT - eliminate MSBuild parallel-output races by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5725 * .NET: Hosted-Files sample + AgentSessionFiles SDK companion + integration test by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5698 * .NET: Simplify ClientHeadersScope to rely on AsyncLocal natural restoration by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5676 * .NET: Hosted Agents - RAG Sample with Azure AI Search (#5693) by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5701 * .NET: Fix/per service input persistence on stream error by @alliscode in https://github.com/microsoft/agent-framework/pull/5744 * .NET: Remove Foundry Toolbox server-side tools support by @alliscode in https://github.com/microsoft/agent-framework/pull/5753 * .NET: DevUI: add configurable access controls for the DevUI HTTP surface by @moonbox3 in https://github.com/microsoft/agent-framework/pull/5739 * .NET: Add A2A input-request content for human-in-the-loop scenarios by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5743 * .NET fix: Synthesized Handoff FunctionResult is never sent to agent by @lokitoth in https://github.com/microsoft/agent-framework/pull/5718 * .NET: Refactor harness console rendering by @westey-m in https://github.com/microsoft/agent-framework/pull/5751 * .NET: fix: align Anthropic Extensions AI version by @danyalahmed1995 in https://github.com/microsoft/agent-framework/pull/5709 * .NET: declare Magentic protocol messages by @he-yufeng in https://github.com/microsoft/agent-framework/pull/5778 * .NET: Feat/dotnet shell tool by @alliscode in https://github.com/microsoft/agent-framework/pull/5604 * .NET: Fix OpenAIResponsesAgentClient to include agentName in endpoint path by @giles17 in https://github.com/microsoft/agent-framework/pull/5748 * .NET: CI hardening — split Functions tests, re-enable skipped integration tests by @giles17 in https://github.com/microsoft/agent-framework/pull/5717 * .NET: Add harness agent package by @westey-m in https://github.com/microsoft/agent-framework/pull/5782 * .NET: [Breaking Change] Auto-wire ChatClient with OpenTelemetryChatClient in OpenTelemetryAgent by @Copilot in https://github.com/microsoft/agent-framework/pull/5750 * Dotnet: Fixing FoundryToolboxMcp sample to use created toolbox by @alliscode in https://github.com/microsoft/agent-framework/pull/5786 * .NET: fix: avoid mutating handoff message roles by @he-yufeng in https://github.com/microsoft/agent-framework/pull/5808 * .NET: feat(evals): add ground_truth/expected_output support for workflow evaluation by @alliscode in https://github.com/microsoft/agent-framework/pull/5755 * .NET: Update version for release. by @alliscode in https://github.com/microsoft/agent-framework/pull/5789 * .NET: Fix build issue CA1873 in DevUI by using LoggerMessage source generator by @alliscode in https://github.com/microsoft/agent-framework/pull/5831 * [BREAKING] Python: DevUI: tighten default access controls and CORS posture by @moonbox3 in https://github.com/microsoft/agent-framework/pull/5740 * [BREAKING] Python: Align file skill folder discovery with agentskills.io spec by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5807 * .NET: Filestore improvements by @westey-m in https://github.com/microsoft/agent-framework/pull/5842 * .NET: DevUI: quarantine flaky discovery integration test (#5845) by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5846 * .NET: Update version to 1.6.1 for release by @westey-m in https://github.com/microsoft/agent-framework/pull/5843 **Full Changelog**: https://github.com/microsoft/agent-framework/compare/dotnet-1.5.0...dotnet-1.6.1 ## 1.6.0 ## [1.6.0] - 2026-05-21 ### Added - **agent-framework-core**: Shell tool with support for local and Docker execution ([#5664](https://github.com/microsoft/agent-framework/pull/5664)) - **agent-framework-monty**: New Monty-backed CodeAct provider package ([#5915](https://github.com/microsoft/agent-framework/pull/5915)) - **agent-framework-foundry**: Add experimental hosted tool factories on `FoundryChatClient` ([#5958](https://github.com/microsoft/agent-framework/pull/5958)) - **agent-framework-foundry**: Include tool definitions for Foundry agent evals ([#5974](https://github.com/microsoft/agent-framework/pull/5974)) - **agent-framework-a2a**: Use non-streaming transport and `return_immediately` for background ops ([#5963](https://github.com/microsoft/agent-framework/pull/5963)) ### Changed - **agent-framework-core**, **agent-framework-foundry**: [BREAKING] Enable instrumentation by default ([#5865](https://github.com/microsoft/agent-framework/pull/5865)) - **agent-framework-foundry**: Show more authentication methods in Foundry Toolbox MCP ([#5719](https://github.com/microsoft/agent-framework/pull/5719)) ### Fixed - **agent-framework-core**: Skip MCP prompt loading when unsupported ([#5370](https://github.com/microsoft/agent-framework/pull/5370)) ## 1.5.0 ## What's Changed * .NET: feat: Implement message filtering to exclude non-portable content typ… by @tarockey in https://github.com/microsoft/agent-framework/pull/5410 * .NET: Add allow listing for WebBrowsingTool by @westey-m in https://github.com/microsoft/agent-framework/pull/5605 * .NET: fix: JSON Serialization issue with MultiPartyConversation by @lokitoth in https://github.com/microsoft/agent-framework/pull/5653 * .NET: Improve Todo multithreading and inject todos into message list by @westey-m in https://github.com/microsoft/agent-framework/pull/5655 * .NET: fix: Add missing Workflows "Shared" sources to solution by @lokitoth in https://github.com/microsoft/agent-framework/pull/5656 * .NET: Fix QuestionExecutor looping after GotoAction re-entry in declarative workflows by @peibekwe in https://github.com/microsoft/agent-framework/pull/5635 * .NET: Fix YAML block scalar parsing for file skills by @tejakusireddy in https://github.com/microsoft/agent-framework/pull/5610 * .NET: Add hosted agent observability sample by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5660 * .NET: Bump MEAI to 10.5.1 and add Foundry per-call x-client header support by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5652 * .NET: Fix flaky declarative test by @peibekwe in https://github.com/microsoft/agent-framework/pull/5669 * .NET: Add Foundry.Hosting.IntegrationTests by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5598 * .NET: Issue 5662 by @alliscode in https://github.com/microsoft/agent-framework/pull/5668 * .NET: Support reasoning events in AGUI by @jeffinsibycoremont in https://github.com/microsoft/agent-framework/pull/4953 * .NET: feat: Update Github Copilot SDK to 1.0.0-beta.2 by @lokitoth in https://github.com/microsoft/agent-framework/pull/5699 * .NET: feat: Implement Magentic Orchestration for .NET by @lokitoth in https://github.com/microsoft/agent-framework/pull/5595 * .NET: Foundry.Hosting IT - avoid MSB3026 in publish step by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5689 * .NET: Python: Add dotnet integration test report to CI by @giles17 in https://github.com/microsoft/agent-framework/pull/5515 * .NET: Non-thread-safe sequence number generation may cause duplicate or out-of-order IDs by @tuanaiseo in https://github.com/microsoft/agent-framework/pull/5320 * .NET: Fix typo: sesionElement -> sessionElement by @XiongHaoTrigger in https://github.com/microsoft/agent-framework/pull/5674 * .NET: Mark Magentic Orchestration Experimental by @lokitoth in https://github.com/microsoft/agent-framework/pull/5704 * .NET: Fix function_call_output.output to be a JSON string on the wire by @alliscode in https://github.com/microsoft/agent-framework/pull/5705 * .NET: Update version for release by @lokitoth in https://github.com/microsoft/agent-framework/pull/5703 ## New Contributors * @tarockey made their first contribution in https://github.com/microsoft/agent-framework/pull/5410 * @tejakusireddy made their first contribution in https://github.com/microsoft/agent-framework/pull/5610 * @jeffinsibycoremont made their first contribution in https://github.com/microsoft/agent-framework/pull/4953 * @tuanaiseo made their first contribution in https://github.com/microsoft/agent-framework/pull/5320 * @XiongHaoTrigger made their first contribution in https://github.com/microsoft/agent-framework/pull/5674 **Full Changelog**: https://github.com/microsoft/agent-framework/compare/dotnet-1.4.0...dotnet-1.5.0 ## 1.4.0 ## What's Changed * .NET: Bump OpenTelemetry packages to 1.15.3 by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5478 * .NET: Support returning durable workflow results from HTTP trigger endpoint by @kshyju in https://github.com/microsoft/agent-framework/pull/5321 * .NET: [Breaking] Support string[] arguments for file-based skill scripts by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5475 * .NET: Add HttpRequestAction support to declarative workflows by @peibekwe in https://github.com/microsoft/agent-framework/pull/5474 * .NET: Add declarative HttpRequestAction sample by @peibekwe in https://github.com/microsoft/agent-framework/pull/5572 * .NET: dotnet: Add hosted-agent User-Agent supplement to outgoing requests by @alliscode in https://github.com/microsoft/agent-framework/pull/5453 * .NET: Add dedicated Foundry.Hosting UnitTest project by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5592 * .NET: Harness Feature branch by @westey-m in https://github.com/microsoft/agent-framework/pull/5310 * .NET: Hosting updates to declarative workflows by @alliscode in https://github.com/microsoft/agent-framework/pull/5589 * docs: enhance README with 1.0 features and improved structure by @chetantoshniwal in https://github.com/microsoft/agent-framework/pull/5534 * .NET: Update version for release by @westey-m in https://github.com/microsoft/agent-framework/pull/5636 * .NET: Add Microsoft.Agents.AI.Hyperlight package for CodeAct integration (.NET) by @eavanvalkenburg in https://github.com/microsoft/agent-framework/pull/5329 **Full Changelog**: https://github.com/microsoft/agent-framework/compare/dotnet-1.3.0...dotnet-1.4.0 ## 1.3.0 ## What's Changed * .NET: Add dynamic tool expansion sample by @westey-m in https://github.com/microsoft/agent-framework/pull/5425 * .NET: Update Aspire package to be preview by @westey-m in https://github.com/microsoft/agent-framework/pull/5444 * .NET: Fix off-thread RunStatus race where GetStatusAsync can return Running after ResumeAsync halts by @peibekwe in https://github.com/microsoft/agent-framework/pull/5412 * .NET: Update versions for release by @westey-m in https://github.com/microsoft/agent-framework/pull/5449 * .NET: Add streaming support to A2A agent handler by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5427 * .NET: dotnet: Add server-side Foundry Toolbox support and fix SDK beta.4 br… by @alliscode in https://github.com/microsoft/agent-framework/pull/5450 **Full Changelog**: https://github.com/microsoft/agent-framework/compare/dotnet-1.2.0...dotnet-1.3.0 ## 1.2.2 ## [1.2.2] - 2026-04-29 ### Added - **agent-framework-azure-contentunderstanding**: New alpha package — Azure AI Content Understanding context provider that auto-analyzes file attachments (documents, images, audio, video) and injects structured results into the LLM context, with multi-document session state, configurable timeout, output filtering via `AnalysisSection`, and auto-registered `list_documents` / `get_analyzed_document` tools ([#4829](https://github.com/microsoft/agent-framework/pull/4829)) - **agent-framework-foundry-hosting**: Add hosted Durable Workflow support — propagate full conversation history to workflow agents and wire `Workflow.as_agent()` end-to-end via the foundry hosting layer ([#5531](https://github.com/microsoft/agent-framework/pull/5531)) ### Changed - **agent-framework-orchestrations**: [BREAKING] Standardize orchestration terminal outputs as `AgentResponse` so `Workflow.as_agent()` returns the final answer only; aligns sequential-approval (`with_request_info`) and concurrent (`intermediate_outputs=True`) flows on the same output contract ([#5301](https://github.com/microsoft/agent-framework/pull/5301)) - **agent-framework-core**, **agent-framework-declarative**: Preserve `Workflow.run()` shared state across calls so multi-turn `WorkflowAgent` invocations retain context, accept `list[Message]` input in the declarative start executor, and coerce `Enum` values when serializing PowerFx symbols ([#5531](https://github.com/microsoft/agent-framework/pull/5531)) - **dependencies**: Update workspace package dependencies and preserve `mcp[ws]` / `uvicorn[standard]` extras through override-dependencies in `/python` ([#5555](https://github.com/microsoft/agent-framework/pull/5555)) ### Fixed - **agent-framework-core**: Fix observability spans not being correctly nested when using streaming ([#5552](https://github.com/microsoft/agent-framework/pull/5552)) - **agent-framework-openai**: Fix `file_search` citations breaking the assistant-message history roundtrip — skip `hosted_file` content in the assistant role so the Responses API no longer rejects `input_file` ([#5557](https://github.com/microsoft/agent-framework/pull/5557)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.2.1...python-1.2.2 ## 1.2.1 ## [1.2.1] - 2026-04-28 ### Added - **agent-framework-foundry-hosting**: Add file data type support to hosted-agent Responses, refresh `foundry-hosted-agents` samples, and add response test coverage ([#5485](https://github.com/microsoft/agent-framework/pull/5485)) - **samples**: Add `requirements.txt` and `.env.example` to the `a2a/` hosting sample for pip-based setup ([#5510](https://github.com/microsoft/agent-framework/pull/5510)) ### Changed - **dependencies**: Update `rich` requirement from `<15.0.0,>=13.7.1` to `>=13.7.1,<16.0.0` in `/python` ([#5227](https://github.com/microsoft/agent-framework/pull/5227)) - **dependencies**: Bump `prek` from `0.3.8` to `0.3.9` in `/python` ([#5228](https://github.com/microsoft/agent-framework/pull/5228)) - **dependencies**: Bump `python-multipart` from `0.0.22` to `0.0.26` in `/python` ([#5286](https://github.com/microsoft/agent-framework/pull/5286)) - **dependencies**: Bump `pyasn1` from `0.6.2` to `0.6.3` in `/python` ([#4748](https://github.com/microsoft/agent-framework/pull/4748)) - **dependencies**: Bump `pytest` from `9.0.2` to `9.0.3` in `/python/packages/ag-ui` ([#5461](https://github.com/microsoft/agent-framework/pull/5461)) - **dependencies**: Bump `pytest` from `9.0.2` to `9.0.3` in `/python/packages/devui` ([#5492](https://github.com/microsoft/agent-framework/pull/5492)) - **dependencies**: Bump `pytest` from `9.0.2` to `9.0.3` in `/python/packages/lab` ([#5470](https://github.com/microsoft/agent-framework/pull/5470)) - **dependencies**: Bump `uv` from `0.11.3` to `0.11.6` in `/python/packages/lab` ([#5469](https://github.com/microsoft/agent-framework/pull/5469)) - **dependencies**: Bump `vite` from `7.1.12` to `7.3.2` in `/python/packages/devui/frontend` ([#5127](https://github.com/microsoft/agent-framework/pull/5127)) - **dependencies**: Bump `vite` from `7.1.12` to `7.3.2` in `/python/samples/05-end-to-end/chatkit-integration/frontend` ([#5126](https://github.com/microsoft/agent-framework/pull/5126)) - **dependencies**: Bump `postcss` from `8.5.6` to `8.5.10` in `/python/packages/devui/frontend` ([#5484](https://github.com/microsoft/agent-framework/pull/5484)) - **dependencies**: Bump `postcss` from `8.5.6` to `8.5.10` in `/python/samples/05-end-to-end/chatkit-integration/frontend` ([#5491](https://github.com/microsoft/agent-framework/pull/5491)) - **dependencies**: Bump `postcss` from `8.5.6` to `8.5.12` in `/python/samples/05-end-to-end/ag_ui_workflow_handoff/frontend` ([#5527](https://github.com/microsoft/agent-framework/pull/5527)) - **dependencies**: Bump `picomatch` from `4.0.3` to `4.0.4` in `/python/packages/devui/frontend` ([#4921](https://github.com/microsoft/agent-framework/pull/4921)) - **dependencies**: Bump `picomatch` from `4.0.3` to `4.0.4` in `/python/samples/05-end-to-end/ag_ui_workflow_handoff/frontend` ([#4936](https://github.com/microsoft/agent-framework/pull/4936)) ### Fixed - **agent-framework-core**: Prevent `inner_exception` from being lost in `AgentFrameworkException` ([#5167](https://github.com/microsoft/agent-framework/pull/5167)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.2.0...python-1.2.1 ## 1.2.0 ## Changes: * f2b215a2f6d4767fd37b17dd33195100ea2e498f .NET [WIP] Foundry Hosted Agents Support (#5312) [ #5091, #5287, #5278, #5281, #5316, #5336, #5341, #5367, #5368, #5371, #5374, #5406, #5408 ] * 57fa8ea9022ac9ec39fb5ececb020aa042599c8f Python: Fix OpenAIEmbeddingClient to use AsyncOpenAI for /openai/v1 endpoints (#5137) [ #5068 ] * aa582d021d69dd3b047d7664ced090dcc08b56f2 Python: feat(evals): add ground_truth support for similarity evaluator (#5234) * 8f17067383154e87e3a3c8ae673c7b5f1cf71add .NET: Update .NET package version 1.2.0 (#5364) * 267351b7607595cfcb2d64c739587bc50a476e2f .NET: Expand Workflow Unit Test Coverage (#5390) * adcd2d33f5e32be85ea141fc8cc6fbe590aa0981 .NET: Declarative workflows - Gracefully handle agent scenarios when no response is returned (#5376) * d5777bc546ba48652d85cec6093b445965533a4a fix: Duplicate CallIds cause Handoff Message Filtering to fail (#5359) * b6b191ad9c2ddaaa8a647419135f01a2d3fce73a Python: Add second approval-required tool (set_stop_loss) to concurrent_builder_tool_approval sample (#4875) [ #4874 ] * 2c8036779c20e5fa2feb6304c01e28c594e801a9 Python: Bump versions for a release. Update CHANGELOG (#5385) * ce8b6305d8e7280ac9d22226a17e2e4f0828ef97 Python: Foundry hosted agent V2 (#5379) [ #5177, #5215, #5235, #5261, #5281, #5284, #5298, #5372, #5378 ] <details><summary><b>See More</b></summary> * 07f4c8a8d66d2fba40bdd086f16cc6dca059d054 Python: Expose forwardedProps to agents and tools via session metadata (#5264) [ #5239 ] * 04aaf0c1fe6023a579a334f9d2afe5b79ca497f0 Python: Add support for Foundry Toolboxes (#5346) * 3e54a689fc96d681a072fe7e7cfc445909dac74b Python: Add search tool content for OpenAI responses (#5302) * 60af59ba8b3c871065d0a288f21bfd7f0d6be3c1 .NET: Features/3768-devui-aspire-integration (#3771) * 69894eded89d6e8ebf7bdb75cd0d9da54ade8b21 Python: Flatten hyperlight execute_code output (#5333) * 495e1dad6bf3c62b14929805cfd5f0409c897876 Python: Fix CopilotStudioAgent to reuse conversation ID from existing session (#5299) [ #5285 ] * 5777ed26e62e721375f78c404b8df1dfbc322560 .NET: fix: Add session support for Handoff-hosted Agents (#5280) * 52303a8d07e8f9f2c3f056d969d99a9062c06219 .NET: Add Code Interpreter container file download samples (#5014) [ #3081 ] * c85d24da440ebe5266852f6356aecdadc41379c6 .NET: Fix declarative resume edge predicates to recognize both direct and PortableValue-wrapped forms after checkpoint restore (#5323) * b03cb324d5cc5e91a55b5eb9045b8ead244aaf11 Python: Add Hyperlight CodeAct package and docs (#5185) * dbf935b4e30cf9ae2553cad54f6bc09668f7eb62 .NET: fix: Foundry Agents without description in Handoff (#5311) * ca580a8316a904e947e48aaba8f3c00eb738ae36 .NET: Add error checking to workflow samples (#5175) * 101e07b0610e2a73e0c369be7e81907a44fb243f .NET: Add Handoff sample (#5245) * aee1acbf8baeb9fb3b3f196975aae9e7f7481096 .NET: Foundry Evals integration for .NET (#4914) [ #5269 ] * 91e34358eb4f2643b13537b470d8ea0aeaec7307 Python: Feat: Add finish_reason support to AgentResponse and AgentResponseUpdate (#5211) [ #4622 ] * 90a633967ca60601fc696d335d770f9f05e236e2 Python: Fix Gemini client support for Gemini API and Vertex AI (#5258) * c14beedb3af8bdee168e3a06a245a5b9d8fa5f75 test: Add Handoff composability test (#5208) * 43d98974d3994486a35602467efcffb85839ce66 fix: propagate A2A metadata with namespaced key in additional_properties (#5240) (#5256) * 60da0ffb4803e0db18d3d3bde8e008eb4277882c .NET: Improve local release build perf by only formatting for one build target framework (#5266) * a2044829b13659ac40f7f4112f74efcce15397cc .NET: Update Microsoft.Extensions.AI to 10.5.0 and OpenAI to 2.10.0 and remove unused refs (#5269) * 435c66e9c9f215fdea4b041da35e6ca774b63094 Python: Handle url_citation annotations in `FoundryChatClient` streaming responses (#5071) [ #5029 ] * 52d50be9e06456aa8dc4adb2525b0bbd4f60d4d3 Bump Anthropic SDK to 12.13.0 and Anthropic.Foundry to 0.5.0 (#5279) * d20f9b5f973b0b8f693f530a8e3c0f9d9c99bb94 Add AgentExecutorResponse.with_text() to preserve conversation history through custom executors (#5255) [ #5246 ] * 87a8fa2a9d0ffd3d0b4b31882e70c4f60462bb29 .NET: Fix intermittent checkpoint-restore race in in-process workflow runs (#5134) * 8f7fd9525d1bf24f9606779ba7f8d41b66ce2ff1 Python: Add OpenAI types to default checkpoint encoding allow list (#5297) * 69697065ab78502c5e58a7e6bc90ae14fdc46c20 Python: Add context_providers and description to `workflow.as_agent()` (#4651) * fe4cd3cddc99f157710296dad892bec427cae991 Revert to public MCP server and skip on transient upstream errors (#5296) * 611230cc8ebde031d6c15dbc15d7053ddf56b40c Python: improve misc-integration test robustness (#5295) * f112150cfbc4d514b21b60a81bbe5239b4b2c81f Python: bump misc-integration retry delay to 30s (#5293) * ff05c22c5853a51b83c05b6fdb3b8e982bbf3b31 Python: add experimental file history provider (#5248) * eab7f09d03387a2b393f9785963353c1a09e8b6b Forward provider config to SessionConfig in GitHubCopilotAgent (fixes #5190) (#5195) * 68b93641b6802abd2d00a5191cb16c6074d39fe1 Python: Bump agent-framework-devui to 1.0.0b260414 for release (#5259) * 2b251d904f1cb045ec3b7e13411cac3c1aa1e019 Python: Fix reasoning replay when store=False (#5250) * 485af07b8c21896b7f24a0313b5a226b3bd711f8 Python: Add GeminiChatClient (#4847) ... (truncated) ## 1.1.1 ## [1.1.1] - 2026-04-23 ### Added - **agent-framework-core**: Add `expected_output` ground-truth support to `evaluate_workflow` for similarity evaluators ([#5234](https://github.com/microsoft/agent-framework/pull/5234)) - **agent-framework-ag-ui**, **agent-framework-a2a**: Propagate `thread_id` and `forwarded_props` through AG-UI to A2A `context_id` ([#5383](https://github.com/microsoft/agent-framework/pull/5383)) - **samples**: Add second approval-required tool (`set_stop_loss`) to `concurrent_builder_tool_approval` sample ([#4875](https://github.com/microsoft/agent-framework/pull/4875)) - **agent-framework-core**: Add `SKIP_PARSING` sentinel for `FunctionTool.invoke` to bypass `Content`-wrapping and return raw function results ([#5424](https://github.com/microsoft/agent-framework/pull/5424)) ### Changed - **agent-framework-foundry-hosting**: Correct Development Status classifier from Beta (4) to Alpha (3) to match the package's lifecycle stage ([#5387](https://github.com/microsoft/agent-framework/pull/5387)) - **tests**: Add Python flaky test report workflow ([#5342](https://github.com/microsoft/agent-framework/pull/5342)) - **agent-framework-hyperlight**: Simplify host callback to pass raw Python results via `SKIP_PARSING`, switch `execute_code` input schema to a plain JSON-schema dict, and tighten public API surface ([#5424](https://github.com/microsoft/agent-framework/pull/5424)) ### Fixed - **agent-framework-openai**: Fix OpenAI Responses streaming to propagate `created_at` from the final `response.completed` event ([#5382](https://github.com/microsoft/agent-framework/pull/5382)) - **agent-framework-openai**: Fix `OpenAIEmbeddingClient` to use `AsyncOpenAI` for `/openai/v1` endpoints ([#5137](https://github.com/microsoft/agent-framework/pull/5137)) - **agent-framework-openai**: Exclude null `file_id` from `input_image` payload to prevent schema 400 errors ([#5125](https://github.com/microsoft/agent-framework/pull/5125)) - **agent-framework-foundry**: Reconcile Toolbox hosted-tool payloads with the Responses API ([#5414](https://github.com/microsoft/agent-framework/pull/5414)) - **agent-framework-ag-ui**: Pass client `thread_id` as `session_id` when constructing `AgentSession` ([#5384](https://github.com/microsoft/agent-framework/pull/5384)) - **agent-framework-hyperlight**: Thread-confine `WasmSandbox` interactions via per-entry `ThreadPoolExecutor` to eliminate the PyO3 `unsendable` panic when touched from asyncio worker threads ([#5424](https://github.com/microsoft/agent-framework/pull/5424)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.1.0...python-1.1.1 ## 1.1.0 ## Changes: * 3e864cdb4c6031cf93096fa6af4d927b31126d8a .NET: Update version to 1.1.0 (#5204) * 14d2ab3262580a383472b406d97b36cfd86b2787 Standardize file skills terminology on 'directory' (#5205) * e5f7b9c260961916e108ca10780988aeefd51662 .NET: Support reflection for discovery of resources and scripts in class-based skills (#5183) <details><summary><b>See More</b></summary> * 1dd828d25502a1d4b4facff8e278da0668b40d28 CHANGELOG Update with V1.0.0 Release (#5069) * 8348584ac29f91a2c5e5e3db05166add1bb7b2af VerifySamples: Filter projects to net10 only (#5184) * 6d6cb840aec8b85c6bb5e95dc680c8fdd6110394 .NET: Improve resilience of verify-samples by building separately and improving evaluation instructions (#5151) * 79afda1a6c4103baa5ae3a42b3004a9e1d28f892 Samples fixes (#5169) * a7a02c1abd87cdb69637aa6f51b98632b9b980c4 Fix test compat for entity key validation (#5179) * 7010dd7439d1fd8f377ad062c7483edb1da60118 .NET: Support custom types in skill resource and script functions (#5152) * e10d448ae29417f3aa107973ab7f7c2745cf7993 Fix handoff workflow context management and improve AG-UI demo (#5136) * 942cb04ccb5adb3726f292659a7b61b5d67681b6 .NET: Fix compaction chat history duplication bug (#5149) * e224f06e601a8ae16ea78c28f434848f332595a3 .NET: Update models used in dotnet samples to gpt-5.4-mini (#5080) * 826d8db84c25389defa7aa13caa2016689c1b975 .NET: fix: Concurrent Workflow Sample (#5090) * 4134c74060d37db60c600a5b748a4f7bfeb2ae41 Add CreateSessionAsync(conversationId) to FoundryAgent (#5144) [ #5138 ] * 86b49d800e9dc37df9d07f7924c9445ba5b8d2c2 Fix and simplify ComputerUse sample (#5075) * d73c06fa8c1bcb9dc3351d3c80f023d4192765b7 .NET: Align skill folder discovery with spec (#5078) * 746c7da216b9cf8d8affbfe40445fd6bcd3ae291 Revise agent examples in README.md (#5067) * d30103fee6b03e2322dc13d590ef43661692b7c9 .NET: Fix input signal issue during checkpoint restoration (#5085) * 55ae57c0ed403c10fc3520505198ca32e71e76d8 .NET: Add Message Delivery Callback Overloads to Executor (#5081) * d284d96a9ed6cbe9220837e139ccb7202e5b5659 fix: 04_MultiModelService sample (#5074) * d1a81159de1b51113c7a0357fdde14aebf1afb79 Bump Anthropic from 12.8.0 to 12.11.0 (#5055) * 9f0dbe5f8dc0c22861e761a26c4c6ed6e2436581 .NET: Improve workflow unit test coverage (#5072) * 3fc1d000265e0db1f434fa5617d6e641b58c61a7 .NET: skill as class (#5027) * e4defadc799cea13efa912e7ee21ce833a5a5c92 .NET: Add github actions workflow for verify-samples (#5034) This list of changes was [auto generated](https://msdata.visualstudio.com/Vienna/_build/results?buildId=214703013&view=logs).</details> ## 1.0.1 ## 1.0.1 - 2026-04-09 > [!IMPORTANT] > **Security hardening for `FileCheckpointStorage`:** Checkpoint deserialization now flows through a restricted unpickler by default, which only permits a built-in set of safe Python types and all `agent_framework` framework types. If your application stores custom types in checkpoints, pass their `"module:qualname"` identifiers via the new `allowed_checkpoint_types` constructor parameter — otherwise loads will raise `WorkflowCheckpointException`. See [Security Considerations](https://learn.microsoft.com/en-us/agent-framework/workflows/checkpoints?pivots=programming-language-python#security-considerations) for details and the opt-in format. ### Added - **samples**: Add sample documentation for two separate Neo4j context providers for retrieval and memory ([#4010](https://github.com/microsoft/agent-framework/pull/4010)) - **agent-framework-azure-cosmos**: Add Cosmos DB NoSQL checkpoint storage for Python workflows ([#4916](https://github.com/microsoft/agent-framework/pull/4916)) ### Changed - **docs**: Remove pre-release flag from agent-framework installation instructions ([#5082](https://github.com/microsoft/agent-framework/pull/5082)) - **samples**: Revise agent examples in `README.md` ([#5067](https://github.com/microsoft/agent-framework/pull/5067)) - **repo**: Update `CHANGELOG` with v1.0.0 release ([#5069](https://github.com/microsoft/agent-framework/pull/5069)) - **agent-framework-core**: [BREAKING] Fix handoff workflow context management and improve AG-UI demo ([#5136](https://github.com/microsoft/agent-framework/pull/5136)) - **agent-framework-core**: Restrict persisted checkpoint deserialization by default ([#4941](https://github.com/microsoft/agent-framework/pull/4941)) - **samples**: Bump `vite` from 7.3.1 to 7.3.2 in `/python/samples/05-end-to-end/ag_ui_workflow_handoff/frontend` ([#5132](https://github.com/microsoft/agent-framework/pull/5132)) - **python**: Bump `cryptography` from 46.0.6 to 46.0.7 ([#5176](https://github.com/microsoft/agent-framework/pull/5176)) - **python**: Bump `mcp` from 1.26.0 to 1.27.0 ([#5117](https://github.com/microsoft/agent-framework/pull/5117)) - **python**: Bump `mcp[ws]` from 1.26.0 to 1.27.0 ([#5119](https://github.com/microsoft/agent-framework/pull/5119)) ### Fixed - **agent-framework-core**: Raise clear handler registration error for unresolved `TypeVar` annotations ([#4944](https://github.com/microsoft/agent-framework/pull/4944)) - **agent-framework-openai**: Fix `response_format` crash on background polling with empty text ([#5146](https://github.com/microsoft/agent-framework/pull/5146)) - **agent-framework-foundry**: Strip tools from `FoundryAgent` request when `agent_reference` is present ([#5101](https://github.com/microsoft/agent-framework/pull/5101)) - **agent-framework-core**: Fix test compatibility for entity key validation ([#5179](https://github.com/microsoft/agent-framework/pull/5179)) - **agent-framework-openai**: Stop emitting duplicate reasoning content from `response.reasoning_text.done` and `response.reasoning_summary_text.done` events ([#5162](https://github.com/microsoft/agent-framework/pull/5162)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.0.0...python-1.0.1 Commits viewable in [compare view](https://github.com/microsoft/agent-framework/commits). </details> Updated [Microsoft.Agents.AI.OpenAI](https://github.com/microsoft/agent-framework) from 1.0.0 to 1.8.0. <details> <summary>Release notes</summary> _Sourced from [Microsoft.Agents.AI.OpenAI's releases](https://github.com/microsoft/agent-framework/releases)._ ## 1.7.0 ## [1.7.0] - 2026-05-28 ### Added - **agent-framework-core**: Add `HarnessAgent` and background-agents harness provider ([#6041](https://github.com/microsoft/agent-framework/pull/6041), [#6069](https://github.com/microsoft/agent-framework/pull/6069)) - **agent-framework-core**, **agent-framework-a2a**: Add `A2AAgentSession` with referenced task IDs and input-required support ([#5980](https://github.com/microsoft/agent-framework/pull/5980)) - **agent-framework-foundry**: Add experimental prompt-agent conversion and deployment APIs ([#5959](https://github.com/microsoft/agent-framework/pull/5959)) - **agent-framework-declarative**: Add Foundry Toolbox MCP invocation support and sample ([#5933](https://github.com/microsoft/agent-framework/pull/5933)) - **samples**: Add hosting samples overview README ([#5407](https://github.com/microsoft/agent-framework/pull/5407)) ### Changed - **agent-framework-core**: Align TodoProvider tool names with the C# implementation ([#6107](https://github.com/microsoft/agent-framework/pull/6107)) - **agent-framework-core**: Align ModeProvider tool names and instructions ([#6071](https://github.com/microsoft/agent-framework/pull/6071)) - **agent-framework-chatkit**: Raise the `openai-chatkit` dependency floor to `>=1.6.4` to match the current typed API usage. - **agent-framework-declarative**: [BREAKING] Remove Python-only declarative actions and rename alias kinds to C# canonical names ([#6126](https://github.com/microsoft/agent-framework/pull/6126)) - **tests**: Replace deprecated `asyncio.iscoroutinefunction` usage in DevUI cleanup-hook tests ([#4563](https://github.com/microsoft/agent-framework/pull/4563)) ### Fixed - **agent-framework-core**: Point `@experimental` warnings at user code ([#5996](https://github.com/microsoft/agent-framework/pull/5996)) - **agent-framework-declarative**: Fix Foreach body exit wiring ([#6050](https://github.com/microsoft/agent-framework/pull/6050)) - **agent-framework-devui**: Fix streaming memory growth regression ([#6038](https://github.com/microsoft/agent-framework/pull/6038)) - **agent-framework-foundry**: Pass default headers to Foundry agents ([#6040](https://github.com/microsoft/agent-framework/pull/6040)) - **agent-framework-foundry-hosting**: Fix hosted handoff argument serialization ([#5861](https://github.com/microsoft/agent-framework/pull/5861)) - **agent-framework-foundry-hosting**: Allow hosted checkpoints to restore `MessageRole` values ([#6049](https://github.com/microsoft/agent-framework/pull/6049)) - **agent-framework-openai**: Preserve citation `get_url` metadata ([#6037](https://github.com/microsoft/agent-framework/pull/6037)) - **agent-framework-openai**: Guard Chat Completions streaming against null deltas ([#5734](https://github.com/microsoft/agent-framework/pull/5734)) - **agent-framework-openai**: Read response headers defensively for stream wrappers without `.headers` ([#6028](https://github.com/microsoft/agent-framework/pull/6028), [#6029](https://github.com/microsoft/agent-framework/pull/6029)) - **samples**: Fix sequential workflow sample output handling ([#5976](https://github.com/microsoft/agent-framework/pull/5976)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.6.0...python-1.7.0 ## 1.6.1 ## What's Changed * .NET: Add hyperlight to release slnf by @westey-m in https://github.com/microsoft/agent-framework/pull/5695 * .NET: Update FoundryAgent to address HostedAgents strict URL routing by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5677 * .NET: Add IChatMessageInjector for message injection during function loop by @westey-m in https://github.com/microsoft/agent-framework/pull/5679 * .NET: Foundry.Hosting IT - eliminate MSBuild parallel-output races by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5725 * .NET: Hosted-Files sample + AgentSessionFiles SDK companion + integration test by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5698 * .NET: Simplify ClientHeadersScope to rely on AsyncLocal natural restoration by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5676 * .NET: Hosted Agents - RAG Sample with Azure AI Search (#5693) by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5701 * .NET: Fix/per service input persistence on stream error by @alliscode in https://github.com/microsoft/agent-framework/pull/5744 * .NET: Remove Foundry Toolbox server-side tools support by @alliscode in https://github.com/microsoft/agent-framework/pull/5753 * .NET: DevUI: add configurable access controls for the DevUI HTTP surface by @moonbox3 in https://github.com/microsoft/agent-framework/pull/5739 * .NET: Add A2A input-request content for human-in-the-loop scenarios by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5743 * .NET fix: Synthesized Handoff FunctionResult is never sent to agent by @lokitoth in https://github.com/microsoft/agent-framework/pull/5718 * .NET: Refactor harness console rendering by @westey-m in https://github.com/microsoft/agent-framework/pull/5751 * .NET: fix: align Anthropic Extensions AI version by @danyalahmed1995 in https://github.com/microsoft/agent-framework/pull/5709 * .NET: declare Magentic protocol messages by @he-yufeng in https://github.com/microsoft/agent-framework/pull/5778 * .NET: Feat/dotnet shell tool by @alliscode in https://github.com/microsoft/agent-framework/pull/5604 * .NET: Fix OpenAIResponsesAgentClient to include agentName in endpoint path by @giles17 in https://github.com/microsoft/agent-framework/pull/5748 * .NET: CI hardening — split Functions tests, re-enable skipped integration tests by @giles17 in https://github.com/microsoft/agent-framework/pull/5717 * .NET: Add harness agent package by @westey-m in https://github.com/microsoft/agent-framework/pull/5782 * .NET: [Breaking Change] Auto-wire ChatClient with OpenTelemetryChatClient in OpenTelemetryAgent by @Copilot in https://github.com/microsoft/agent-framework/pull/5750 * Dotnet: Fixing FoundryToolboxMcp sample to use created toolbox by @alliscode in https://github.com/microsoft/agent-framework/pull/5786 * .NET: fix: avoid mutating handoff message roles by @he-yufeng in https://github.com/microsoft/agent-framework/pull/5808 * .NET: feat(evals): add ground_truth/expected_output support for workflow evaluation by @alliscode in https://github.com/microsoft/agent-framework/pull/5755 * .NET: Update version for release. by @alliscode in https://github.com/microsoft/agent-framework/pull/5789 * .NET: Fix build issue CA1873 in DevUI by using LoggerMessage source generator by @alliscode in https://github.com/microsoft/agent-framework/pull/5831 * [BREAKING] Python: DevUI: tighten default access controls and CORS posture by @moonbox3 in https://github.com/microsoft/agent-framework/pull/5740 * [BREAKING] Python: Align file skill folder discovery with agentskills.io spec by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5807 * .NET: Filestore improvements by @westey-m in https://github.com/microsoft/agent-framework/pull/5842 * .NET: DevUI: quarantine flaky discovery integration test (#5845) by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5846 * .NET: Update version to 1.6.1 for release by @westey-m in https://github.com/microsoft/agent-framework/pull/5843 **Full Changelog**: https://github.com/microsoft/agent-framework/compare/dotnet-1.5.0...dotnet-1.6.1 ## 1.6.0 ## [1.6.0] - 2026-05-21 ### Added - **agent-framework-core**: Shell tool with support for local and Docker execution ([#5664](https://github.com/microsoft/agent-framework/pull/5664)) - **agent-framework-monty**: New Monty-backed CodeAct provider package ([#5915](https://github.com/microsoft/agent-framework/pull/5915)) - **agent-framework-foundry**: Add experimental hosted tool factories on `FoundryChatClient` ([#5958](https://github.com/microsoft/agent-framework/pull/5958)) - **agent-framework-foundry**: Include tool definitions for Foundry agent evals ([#5974](https://github.com/microsoft/agent-framework/pull/5974)) - **agent-framework-a2a**: Use non-streaming transport and `return_immediately` for background ops ([#5963](https://github.com/microsoft/agent-framework/pull/5963)) ### Changed - **agent-framework-core**, **agent-framework-foundry**: [BREAKING] Enable instrumentation by default ([#5865](https://github.com/microsoft/agent-framework/pull/5865)) - **agent-framework-foundry**: Show more authentication methods in Foundry Toolbox MCP ([#5719](https://github.com/microsoft/agent-framework/pull/5719)) ### Fixed - **agent-framework-core**: Skip MCP prompt loading when unsupported ([#5370](https://github.com/microsoft/agent-framework/pull/5370)) ## 1.5.0 ## What's Changed * .NET: feat: Implement message filtering to exclude non-portable content typ… by @tarockey in https://github.com/microsoft/agent-framework/pull/5410 * .NET: Add allow listing for WebBrowsingTool by @westey-m in https://github.com/microsoft/agent-framework/pull/5605 * .NET: fix: JSON Serialization issue with MultiPartyConversation by @lokitoth in https://github.com/microsoft/agent-framework/pull/5653 * .NET: Improve Todo multithreading and inject todos into message list by @westey-m in https://github.com/microsoft/agent-framework/pull/5655 * .NET: fix: Add missing Workflows "Shared" sources to solution by @lokitoth in https://github.com/microsoft/agent-framework/pull/5656 * .NET: Fix QuestionExecutor looping after GotoAction re-entry in declarative workflows by @peibekwe in https://github.com/microsoft/agent-framework/pull/5635 * .NET: Fix YAML block scalar parsing for file skills by @tejakusireddy in https://github.com/microsoft/agent-framework/pull/5610 * .NET: Add hosted agent observability sample by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5660 * .NET: Bump MEAI to 10.5.1 and add Foundry per-call x-client header support by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5652 * .NET: Fix flaky declarative test by @peibekwe in https://github.com/microsoft/agent-framework/pull/5669 * .NET: Add Foundry.Hosting.IntegrationTests by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5598 * .NET: Issue 5662 by @alliscode in https://github.com/microsoft/agent-framework/pull/5668 * .NET: Support reasoning events in AGUI by @jeffinsibycoremont in https://github.com/microsoft/agent-framework/pull/4953 * .NET: feat: Update Github Copilot SDK to 1.0.0-beta.2 by @lokitoth in https://github.com/microsoft/agent-framework/pull/5699 * .NET: feat: Implement Magentic Orchestration for .NET by @lokitoth in https://github.com/microsoft/agent-framework/pull/5595 * .NET: Foundry.Hosting IT - avoid MSB3026 in publish step by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5689 * .NET: Python: Add dotnet integration test report to CI by @giles17 in https://github.com/microsoft/agent-framework/pull/5515 * .NET: Non-thread-safe sequence number generation may cause duplicate or out-of-order IDs by @tuanaiseo in https://github.com/microsoft/agent-framework/pull/5320 * .NET: Fix typo: sesionElement -> sessionElement by @XiongHaoTrigger in https://github.com/microsoft/agent-framework/pull/5674 * .NET: Mark Magentic Orchestration Experimental by @lokitoth in https://github.com/microsoft/agent-framework/pull/5704 * .NET: Fix function_call_output.output to be a JSON string on the wire by @alliscode in https://github.com/microsoft/agent-framework/pull/5705 * .NET: Update version for release by @lokitoth in https://github.com/microsoft/agent-framework/pull/5703 ## New Contributors * @tarockey made their first contribution in https://github.com/microsoft/agent-framework/pull/5410 * @tejakusireddy made their first contribution in https://github.com/microsoft/agent-framework/pull/5610 * @jeffinsibycoremont made their first contribution in https://github.com/microsoft/agent-framework/pull/4953 * @tuanaiseo made their first contribution in https://github.com/microsoft/agent-framework/pull/5320 * @XiongHaoTrigger made their first contribution in https://github.com/microsoft/agent-framework/pull/5674 **Full Changelog**: https://github.com/microsoft/agent-framework/compare/dotnet-1.4.0...dotnet-1.5.0 ## 1.4.0 ## What's Changed * .NET: Bump OpenTelemetry packages to 1.15.3 by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5478 * .NET: Support returning durable workflow results from HTTP trigger endpoint by @kshyju in https://github.com/microsoft/agent-framework/pull/5321 * .NET: [Breaking] Support string[] arguments for file-based skill scripts by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5475 * .NET: Add HttpRequestAction support to declarative workflows by @peibekwe in https://github.com/microsoft/agent-framework/pull/5474 * .NET: Add declarative HttpRequestAction sample by @peibekwe in https://github.com/microsoft/agent-framework/pull/5572 * .NET: dotnet: Add hosted-agent User-Agent supplement to outgoing requests by @alliscode in https://github.com/microsoft/agent-framework/pull/5453 * .NET: Add dedicated Foundry.Hosting UnitTest project by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5592 * .NET: Harness Feature branch by @westey-m in https://github.com/microsoft/agent-framework/pull/5310 * .NET: Hosting updates to declarative workflows by @alliscode in https://github.com/microsoft/agent-framework/pull/5589 * docs: enhance README with 1.0 features and improved structure by @chetantoshniwal in https://github.com/microsoft/agent-framework/pull/5534 * .NET: Update version for release by @westey-m in https://github.com/microsoft/agent-framework/pull/5636 * .NET: Add Microsoft.Agents.AI.Hyperlight package for CodeAct integration (.NET) by @eavanvalkenburg in https://github.com/microsoft/agent-framework/pull/5329 **Full Changelog**: https://github.com/microsoft/agent-framework/compare/dotnet-1.3.0...dotnet-1.4.0 ## 1.3.0 ## What's Changed * .NET: Add dynamic tool expansion sample by @westey-m in https://github.com/microsoft/agent-framework/pull/5425 * .NET: Update Aspire package to be preview by @westey-m in https://github.com/microsoft/agent-framework/pull/5444 * .NET: Fix off-thread RunStatus race where GetStatusAsync can return Running after ResumeAsync halts by @peibekwe in https://github.com/microsoft/agent-framework/pull/5412 * .NET: Update versions for release by @westey-m in https://github.com/microsoft/agent-framework/pull/5449 * .NET: Add streaming support to A2A agent handler by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5427 * .NET: dotnet: Add server-side Foundry Toolbox support and fix SDK beta.4 br… by @alliscode in https://github.com/microsoft/agent-framework/pull/5450 **Full Changelog**: https://github.com/microsoft/agent-framework/compare/dotnet-1.2.0...dotnet-1.3.0 ## 1.2.2 ## [1.2.2] - 2026-04-29 ### Added - **agent-framework-azure-contentunderstanding**: New alpha package — Azure AI Content Understanding context provider that auto-analyzes file attachments (documents, images, audio, video) and injects structured results into the LLM context, with multi-document session state, configurable timeout, output filtering via `AnalysisSection`, and auto-registered `list_documents` / `get_analyzed_document` tools ([#4829](https://github.com/microsoft/agent-framework/pull/4829)) - **agent-framework-foundry-hosting**: Add hosted Durable Workflow support — propagate full conversation history to workflow agents and wire `Workflow.as_agent()` end-to-end via the foundry hosting layer ([#5531](https://github.com/microsoft/agent-framework/pull/5531)) ### Changed - **agent-framework-orchestrations**: [BREAKING] Standardize orchestration terminal outputs as `AgentResponse` so `Workflow.as_agent()` returns the final answer only; aligns sequential-approval (`with_request_info`) and concurrent (`intermediate_outputs=True`) flows on the same output contract ([#5301](https://github.com/microsoft/agent-framework/pull/5301)) - **agent-framework-core**, **agent-framework-declarative**: Preserve `Workflow.run()` shared state across calls so multi-turn `WorkflowAgent` invocations retain context, accept `list[Message]` input in the declarative start executor, and coerce `Enum` values when serializing PowerFx symbols ([#5531](https://github.com/microsoft/agent-framework/pull/5531)) - **dependencies**: Update workspace package dependencies and preserve `mcp[ws]` / `uvicorn[standard]` extras through override-dependencies in `/python` ([#5555](https://github.com/microsoft/agent-framework/pull/5555)) ### Fixed - **agent-framework-core**: Fix observability spans not being correctly nested when using streaming ([#5552](https://github.com/microsoft/agent-framework/pull/5552)) - **agent-framework-openai**: Fix `file_search` citations breaking the assistant-message history roundtrip — skip `hosted_file` content in the assistant role so the Responses API no longer rejects `input_file` ([#5557](https://github.com/microsoft/agent-framework/pull/5557)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.2.1...python-1.2.2 ## 1.2.1 ## [1.2.1] - 2026-04-28 ### Added - **agent-framework-foundry-hosting**: Add file data type support to hosted-agent Responses, refresh `foundry-hosted-agents` samples, and add response test coverage ([#5485](https://github.com/microsoft/agent-framework/pull/5485)) - **samples**: Add `requirements.txt` and `.env.example` to the `a2a/` hosting sample for pip-based setup ([#5510](https://github.com/microsoft/agent-framework/pull/5510)) ### Changed - **dependencies**: Update `rich` requirement from `<15.0.0,>=13.7.1` to `>=13.7.1,<16.0.0` in `/python` ([#5227](https://github.com/microsoft/agent-framework/pull/5227)) - **dependencies**: Bump `prek` from `0.3.8` to `0.3.9` in `/python` ([#5228](https://github.com/microsoft/agent-framework/pull/5228)) - **dependencies**: Bump `python-multipart` from `0.0.22` to `0.0.26` in `/python` ([#5286](https://github.com/microsoft/agent-framework/pull/5286)) - **dependencies**: Bump `pyasn1` from `0.6.2` to `0.6.3` in `/python` ([#4748](https://github.com/microsoft/agent-framework/pull/4748)) - **dependencies**: Bump `pytest` from `9.0.2` to `9.0.3` in `/python/packages/ag-ui` ([#5461](https://github.com/microsoft/agent-framework/pull/5461)) - **dependencies**: Bump `pytest` from `9.0.2` to `9.0.3` in `/python/packages/devui` ([#5492](https://github.com/microsoft/agent-framework/pull/5492)) - **dependencies**: Bump `pytest` from `9.0.2` to `9.0.3` in `/python/packages/lab` ([#5470](https://github.com/microsoft/agent-framework/pull/5470)) - **dependencies**: Bump `uv` from `0.11.3` to `0.11.6` in `/python/packages/lab` ([#5469](https://github.com/microsoft/agent-framework/pull/5469)) - **dependencies**: Bump `vite` from `7.1.12` to `7.3.2` in `/python/packages/devui/frontend` ([#5127](https://github.com/microsoft/agent-framework/pull/5127)) - **dependencies**: Bump `vite` from `7.1.12` to `7.3.2` in `/python/samples/05-end-to-end/chatkit-integration/frontend` ([#5126](https://github.com/microsoft/agent-framework/pull/5126)) - **dependencies**: Bump `postcss` from `8.5.6` to `8.5.10` in `/python/packages/devui/frontend` ([#5484](https://github.com/microsoft/agent-framework/pull/5484)) - **dependencies**: Bump `postcss` from `8.5.6` to `8.5.10` in `/python/samples/05-end-to-end/chatkit-integration/frontend` ([#5491](https://github.com/microsoft/agent-framework/pull/5491)) - **dependencies**: Bump `postcss` from `8.5.6` to `8.5.12` in `/python/samples/05-end-to-end/ag_ui_workflow_handoff/frontend` ([#5527](https://github.com/microsoft/agent-framework/pull/5527)) - **dependencies**: Bump `picomatch` from `4.0.3` to `4.0.4` in `/python/packages/devui/frontend` ([#4921](https://github.com/microsoft/agent-framework/pull/4921)) - **dependencies**: Bump `picomatch` from `4.0.3` to `4.0.4` in `/python/samples/05-end-to-end/ag_ui_workflow_handoff/frontend` ([#4936](https://github.com/microsoft/agent-framework/pull/4936)) ### Fixed - **agent-framework-core**: Prevent `inner_exception` from being lost in `AgentFrameworkException` ([#5167](https://github.com/microsoft/agent-framework/pull/5167)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.2.0...python-1.2.1 ## 1.2.0 ## Changes: * f2b215a2f6d4767fd37b17dd33195100ea2e498f .NET [WIP] Foundry Hosted Agents Support (#5312) [ #5091, #5287, #5278, #5281, #5316, #5336, #5341, #5367, #5368, #5371, #5374, #5406, #5408 ] * 57fa8ea9022ac9ec39fb5ececb020aa042599c8f Python: Fix OpenAIEmbeddingClient to use AsyncOpenAI for /openai/v1 endpoints (#5137) [ #5068 ] * aa582d021d69dd3b047d7664ced090dcc08b56f2 Python: feat(evals): add ground_truth support for similarity evaluator (#5234) * 8f17067383154e87e3a3c8ae673c7b5f1cf71add .NET: Update .NET package version 1.2.0 (#5364) * 267351b7607595cfcb2d64c739587bc50a476e2f .NET: Expand Workflow Unit Test Coverage (#5390) * adcd2d33f5e32be85ea141fc8cc6fbe590aa0981 .NET: Declarative workflows - Gracefully handle agent scenarios when no response is returned (#5376) * d5777bc546ba48652d85cec6093b445965533a4a fix: Duplicate CallIds cause Handoff Message Filtering to fail (#5359) * b6b191ad9c2ddaaa8a647419135f01a2d3fce73a Python: Add second approval-required tool (set_stop_loss) to concurrent_builder_tool_approval sample (#4875) [ #4874 ] * 2c8036779c20e5fa2feb6304c01e28c594e801a9 Python: Bump versions for a release. Update CHANGELOG (#5385) * ce8b6305d8e7280ac9d22226a17e2e4f0828ef97 Python: Foundry hosted agent V2 (#5379) [ #5177, #5215, #5235, #5261, #5281, #5284, #5298, #5372, #5378 ] <details><summary><b>See More</b></summary> * 07f4c8a8d66d2fba40bdd086f16cc6dca059d054 Python: Expose forwardedProps to agents and tools via session metadata (#5264) [ #5239 ] * 04aaf0c1fe6023a579a334f9d2afe5b79ca497f0 Python: Add support for Foundry Toolboxes (#5346) * 3e54a689fc96d681a072fe7e7cfc445909dac74b Python: Add search tool content for OpenAI responses (#5302) * 60af59ba8b3c871065d0a288f21bfd7f0d6be3c1 .NET: Features/3768-devui-aspire-integration (#3771) * 69894eded89d6e8ebf7bdb75cd0d9da54ade8b21 Python: Flatten hyperlight execute_code output (#5333) * 495e1dad6bf3c62b14929805cfd5f0409c897876 Python: Fix CopilotStudioAgent to reuse conversation ID from existing session (#5299) [ #5285 ] * 5777ed26e62e721375f78c404b8df1dfbc322560 .NET: fix: Add session support for Handoff-hosted Agents (#5280) * 52303a8d07e8f9f2c3f056d969d99a9062c06219 .NET: Add Code Interpreter container file download samples (#5014) [ #3081 ] * c85d24da440ebe5266852f6356aecdadc41379c6 .NET: Fix declarative resume edge predicates to recognize both direct and PortableValue-wrapped forms after checkpoint restore (#5323) * b03cb324d5cc5e91a55b5eb9045b8ead244aaf11 Python: Add Hyperlight CodeAct package and docs (#5185) * dbf935b4e30cf9ae2553cad54f6bc09668f7eb62 .NET: fix: Foundry Agents without description in Handoff (#5311) * ca580a8316a904e947e48aaba8f3c00eb738ae36 .NET: Add error checking to workflow samples (#5175) * 101e07b0610e2a73e0c369be7e81907a44fb243f .NET: Add Handoff sample (#5245) * aee1acbf8baeb9fb3b3f196975aae9e7f7481096 .NET: Foundry Evals integration for .NET (#4914) [ #5269 ] * 91e34358eb4f2643b13537b470d8ea0aeaec7307 Python: Feat: Add finish_reason support to AgentResponse and AgentResponseUpdate (#5211) [ #4622 ] * 90a633967ca60601fc696d335d770f9f05e236e2 Python: Fix Gemini client support for Gemini API and Vertex AI (#5258) * c14beedb3af8bdee168e3a06a245a5b9d8fa5f75 test: Add Handoff composability test (#5208) * 43d98974d3994486a35602467efcffb85839ce66 fix: propagate A2A metadata with namespaced key in additional_properties (#5240) (#5256) * 60da0ffb4803e0db18d3d3bde8e008eb4277882c .NET: Improve local release build perf by only formatting for one build target framework (#5266) * a2044829b13659ac40f7f4112f74efcce15397cc .NET: Update Microsoft.Extensions.AI to 10.5.0 and OpenAI to 2.10.0 and remove unused refs (#5269) * 435c66e9c9f215fdea4b041da35e6ca774b63094 Python: Handle url_citation annotations in `FoundryChatClient` streaming responses (#5071) [ #5029 ] * 52d50be9e06456aa8dc4adb2525b0bbd4f60d4d3 Bump Anthropic SDK to 12.13.0 and Anthropic.Foundry to 0.5.0 (#5279) * d20f9b5f973b0b8f693f530a8e3c0f9d9c99bb94 Add AgentExecutorResponse.with_text() to preserve conversation history through custom executors (#5255) [ #5246 ] * 87a8fa2a9d0ffd3d0b4b31882e70c4f60462bb29 .NET: Fix intermittent checkpoint-restore race in in-process workflow runs (#5134) * 8f7fd9525d1bf24f9606779ba7f8d41b66ce2ff1 Python: Add OpenAI types to default checkpoint encoding allow list (#5297) * 69697065ab78502c5e58a7e6bc90ae14fdc46c20 Python: Add context_providers and description to `workflow.as_agent()` (#4651) * fe4cd3cddc99f157710296dad892bec427cae991 Revert to public MCP server and skip on transient upstream errors (#5296) * 611230cc8ebde031d6c15dbc15d7053ddf56b40c Python: improve misc-integration test robustness (#5295) * f112150cfbc4d514b21b60a81bbe5239b4b2c81f Python: bump misc-integration retry delay to 30s (#5293) * ff05c22c5853a51b83c05b6fdb3b8e982bbf3b31 Python: add experimental file history provider (#5248) * eab7f09d03387a2b393f9785963353c1a09e8b6b Forward provider config to SessionConfig in GitHubCopilotAgent (fixes #5190) (#5195) * 68b93641b6802abd2d00a5191cb16c6074d39fe1 Python: Bump agent-framework-devui to 1.0.0b260414 for release (#5259) * 2b251d904f1cb045ec3b7e13411cac3c1aa1e019 Python: Fix reasoning replay when store=False (#5250) * 485af07b8c21896b7f24a0313b5a226b3bd711f8 Python: Add GeminiChatClient (#4847) ... (truncated) ## 1.1.1 ## [1.1.1] - 2026-04-23 ### Added - **agent-framework-core**: Add `expected_output` ground-truth support to `evaluate_workflow` for similarity evaluators ([#5234](https://github.com/microsoft/agent-framework/pull/5234)) - **agent-framework-ag-ui**, **agent-framework-a2a**: Propagate `thread_id` and `forwarded_props` through AG-UI to A2A `context_id` ([#5383](https://github.com/microsoft/agent-framework/pull/5383)) - **samples**: Add second approval-required tool (`set_stop_loss`) to `concurrent_builder_tool_approval` sample ([#4875](https://github.com/microsoft/agent-framework/pull/4875)) - **agent-framework-core**: Add `SKIP_PARSING` sentinel for `FunctionTool.invoke` to bypass `Content`-wrapping and return raw function results ([#5424](https://github.com/microsoft/agent-framework/pull/5424)) ### Changed - **agent-framework-foundry-hosting**: Correct Development Status classifier from Beta (4) to Alpha (3) to match the package's lifecycle stage ([#5387](https://github.com/microsoft/agent-framework/pull/5387)) - **tests**: Add Python flaky test report workflow ([#5342](https://github.com/microsoft/agent-framework/pull/5342)) - **agent-framework-hyperlight**: Simplify host callback to pass raw Python results via `SKIP_PARSING`, switch `execute_code` input schema to a plain JSON-schema dict, and tighten public API surface ([#5424](https://github.com/microsoft/agent-framework/pull/5424)) ### Fixed - **agent-framework-openai**: Fix OpenAI Responses streaming to propagate `created_at` from the final `response.completed` event ([#5382](https://github.com/microsoft/agent-framework/pull/5382)) - **agent-framework-openai**: Fix `OpenAIEmbeddingClient` to use `AsyncOpenAI` for `/openai/v1` endpoints ([#5137](https://github.com/microsoft/agent-framework/pull/5137)) - **agent-framework-openai**: Exclude null `file_id` from `input_image` payload to prevent schema 400 errors ([#5125](https://github.com/microsoft/agent-framework/pull/5125)) - **agent-framework-foundry**: Reconcile Toolbox hosted-tool payloads with the Responses API ([#5414](https://github.com/microsoft/agent-framework/pull/5414)) - **agent-framework-ag-ui**: Pass client `thread_id` as `session_id` when constructing `AgentSession` ([#5384](https://github.com/microsoft/agent-framework/pull/5384)) - **agent-framework-hyperlight**: Thread-confine `WasmSandbox` interactions via per-entry `ThreadPoolExecutor` to eliminate the PyO3 `unsendable` panic when touched from asyncio worker threads ([#5424](https://github.com/microsoft/agent-framework/pull/5424)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.1.0...python-1.1.1 ## 1.1.0 ## Changes: * 3e864cdb4c6031cf93096fa6af4d927b31126d8a .NET: Update version to 1.1.0 (#5204) * 14d2ab3262580a383472b406d97b36cfd86b2787 Standardize file skills terminology on 'directory' (#5205) * e5f7b9c260961916e108ca10780988aeefd51662 .NET: Support reflection for discovery of resources and scripts in class-based skills (#5183) <details><summary><b>See More</b></summary> * 1dd828d25502a1d4b4facff8e278da0668b40d28 CHANGELOG Update with V1.0.0 Release (#5069) * 8348584ac29f91a2c5e5e3db05166add1bb7b2af VerifySamples: Filter projects to net10 only (#5184) * 6d6cb840aec8b85c6bb5e95dc680c8fdd6110394 .NET: Improve resilience of verify-samples by building separately and improving evaluation instructions (#5151) * 79afda1a6…
This was referenced May 29, 2026
This was referenced Jun 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation and Context
Persisted checkpoint loading in the Python SDK is currently too permissive by default: arbitrary pickled types can be restored unless callers add their own safeguards. Before GA, checkpoint persistence should default to a narrower, framework-approved type surface while still giving applications an explicit extension point for additional safe types.
Fixes #4894
Description
This change hardens
FileCheckpointStorageso persisted checkpoints are deserialized with a restricted unpickler by default. Built-in safe value types andagent_frameworkinternal types continue to round-trip without extra configuration, while application-specific types must now be explicitly allowed via the newallowed_checkpoint_typesparameter usingmodule:qualnameentries. The checkpoint encoding layer enforces that allow-list during deserialization, the storage and encoding docs now describe the safer default posture, and the workflow checkpoint tests were updated to cover blocked arbitrary callables and__reduce__payloads, explicit allow-listed custom types, and existing round-trip scenarios that rely on custom test types.Contribution Checklist