github microsoft/agent-framework python-1.25.0
on GitHub

one hour ago

Added

  • agent-framework-core, agent-framework-foundry-hosting: Support callable MCP discovery approval policies and honor Foundry Toolbox approval metadata, including tool-name and read-only filters, explicit caller overrides, and policy refresh for retained tools (#10136)

Changed

  • agent-framework, agent-framework-a2a, agent-framework-ag-ui, agent-framework-anthropic, agent-framework-azure-ai-search, agent-framework-azure-contentunderstanding, agent-framework-azure-cosmos, agent-framework-azure-cosmos-memory, agent-framework-azure-documentdb, agent-framework-bedrock, agent-framework-chatkit, agent-framework-claude, agent-framework-copilotstudio, agent-framework-core, agent-framework-declarative, agent-framework-devui, agent-framework-duckdb, agent-framework-foundry, agent-framework-foundry-hosting, agent-framework-foundry-local, agent-framework-gemini, agent-framework-github-copilot, agent-framework-hosting, agent-framework-hosting-a2a, agent-framework-hosting-mcp, agent-framework-hosting-responses, agent-framework-hosting-telegram, agent-framework-hyperlight, agent-framework-mem0, agent-framework-mistral, agent-framework-mongodb, agent-framework-monty, agent-framework-nvidia, agent-framework-ollama, agent-framework-openai, agent-framework-oracle, agent-framework-orchestrations, agent-framework-postgres, agent-framework-purview, agent-framework-qdrant, agent-framework-redis, agent-framework-sql-server, agent-framework-tools, agent-framework-typesafe: [BREAKING] Remove Python 3.10 installation eligibility and obsolete compatibility branches; require Python 3.11 or later (#9948)

    Migration: Upgrade Python 3.10 environments to Python 3.11 or later before installing this release. Existing integration-specific Python upper bounds still apply; Foundry Local supports Python 3.11-3.14.

  • agent-framework-core, agent-framework-declarative: [BREAKING] Bound MCP tool and prompt discovery to 100 pages and 1,000 items per catalog, default framework-owned request timeouts to 30 seconds, and preserve the complete catalog snapshot when refresh fails (#10042)

    Migration: Increase max_discovery_pages or max_discovery_items for larger catalogs, or set either to None only for a trusted MCP server. Pass request_timeout=None to an MCP tool to restore unlimited request timing. Caller-owned clients retain their own transport and timeout policy. DefaultMCPToolHandler exposes the discovery limits and requires Core 1.25.

  • agent-framework-ag-ui, agent-framework-core, agent-framework-hosting: [BREAKING] Bind live workflow agent executors and their sessions to one authorization scope, reject cross-scope execution before model calls, and reject WorkflowAgent.as_tool() in AG-UI endpoints (#10035)

    Migration: Use AgentFrameworkWorkflow(workflow_factory=...) with a factory that creates new workflows, AgentExecutor instances, and AgentSession instances for each call. A shared builder still reuses its executors, even with cache_target=False. Use single_user=True only when all callers are the same principal. Cross-scope reuse now reports WORKFLOW_SCOPE_CONFLICT; workflow-agent tools report WORKFLOW_AGENT_TOOL_UNSUPPORTED. Serve those workflows directly through a factory instead. This guard covers live executor/session identity, not state loaded from shared storage or custom tool functions that invoke workflows. AG-UI requires Core 1.25 for the wrapped-agent ownership check.

  • agent-framework-core: [BREAKING] Align graph and functional workflow invocation spans with OpenTelemetry GenAI conventions (#9900)

    Migration: Replace exact workflow.run span-name filters with gen_ai.operation.name == "invoke_workflow", and replace workflow.name attribute lookups with gen_ai.workflow.name. Named spans use invoke_workflow {workflow_name}; unnamed graph workflows use invoke_workflow and omit the semantic name attribute. OtelAttr.WORKFLOW_RUN_SPAN now contains the base operation name, not every exported span's full name. Runtime/checkpoint workflow identity and conversation/error attribute names are unchanged.

  • agent-framework-declarative: [BREAKING] Prevent cross-workflow MCP state sharing by creating and closing a fresh protocol session for every handler invocation, including tools/list, instead of caching initialized sessions. This security fix ships in 1.5.0; the legacy cache_max_size parameter remains accepted as a deprecated no-op (#8662)

    Migration: Replace async with DefaultMCPToolHandler(...) as handler: with ordinary handler = DefaultMCPToolHandler(...) construction and remove handler aclose() calls. Existing non-None cache_max_size values are accepted without validation but ignored and emit DeprecationWarning; omit the parameter or pass None to stop the warning. Manage borrowed HTTP clients separately, and cancel and await active invocations before closing them. Implicit server-session continuity no longer survives later calls, approval waits, or checkpoint resumes; use explicit remote state handles or an explicitly scoped custom MCPToolHandler when continuity is required. Workflow checkpoints and approval verification are unchanged; no checkpoint migration flag is introduced.

  • agent-framework-foundry-local: [BREAKING] Migrate to Foundry Local SDK 2.3.1, support SDK-registered local models, and prepare the selected model before first inference while retaining the OpenAI-compatible transport (#9322)

    Migration: Install foundry-local-sdk>=2.3.1,<3 on Python 3.11-3.14 and a supported platform: Apple Silicon macOS, Linux x86_64/aarch64, or Windows x64/ARM64. Configure the shared SDK manager before the first client when custom settings are needed. bootstrap=False requires an initialized manager and running web service; prepare_model=False still loads the selected model on the first request. Remove unsupported do_sample and early_stopping options. Close client HTTP resources before closing the shared manager once at application shutdown. Image support has not been verified; audio and embeddings are outside this SDK migration.

  • agent-framework-hyperlight, agent-framework-monty: [BREAKING] Redact host-tool exception details before generated code resumes, preserve the diagnostic policy in serialized execution state, and isolate Hyperlight sandbox caches by policy (#9971)

    Migration: Handle generic RuntimeError diagnostics instead of matching original host exception types by default. Set the host-side include_detailed_errors=True option only for trusted channels that need original exception types and messages. This option is separate from sensitive-data logging and outer-client error handling.

  • agent-framework-ag-ui, agent-framework-devui, agent-framework-foundry, agent-framework-monty, tests: Expand supported FastAPI and Azure AI Projects dependency ranges, require Pydantic Monty 1.0 or later with the updated runtime bridge, and refresh development dependencies and the standalone Lab lockfile (#10096)

  • agent-framework-core, agent-framework-redis: Enable Redis integration and its standard-install dependency on Python 3.15, and widen the supported RedisVL range to include 0.31 without raising the existing lower bound (#10143)

  • agent-framework, agent-framework-core: Advance the exact Core pin and standard-install dependency cohort to the versions in this release.

  • agent-framework-ag-ui, agent-framework-declarative, agent-framework-foundry-hosting, agent-framework-openai: Require Core 1.25 for the wrapped-agent ownership link, MCP discovery-limit parameters, callable discovery approval policy, or local shell-result replay marker. Retain other Core floors under the strict API-usage policy.

  • agent-framework-hosting-a2a, agent-framework-hosting-mcp, agent-framework-hosting-responses, agent-framework-hosting-telegram: Keep the exact shared hosting dependency pin aligned with its co-released version.

  • agent-framework-purview: Clarify binary-content classification behavior (#10103)

  • docs: Clarify optional usage counters and OpenTelemetry logging-handler behavior, and remove an unused URI pattern while correcting workflow-cycle documentation (#9783, #9897, #10105)

  • docs, samples: Correct Foundry model and connection environment variables in multimodal, Content Understanding, ChatKit, and red-teaming setup guidance, and repair the Rubric evaluator documentation link (#9735, #9740, #9758, #9781, #9906)

  • docs: Add Bhived and Donkey Development Kit community projects, and strengthen API-design and PR-review guidance (#10032, #10086, #10038)

  • tests: Expand optional MCP tool regression coverage and refresh mypy, ty, and standalone Lab test tooling without releasing the excluded Lab workspace (#9937, #10117, #10118, #10119, #10120)

  • tests: Correct native changed-package path routing in repository tooling (#9947)

  • agent-framework-ag-ui, agent-framework-devui, tests: Upgrade root and integration-extra pytest pins together to 9.2.0 and the pinned ty and Zuban checkers to 0.0.95 and 0.10.2 (#10115, #10140)

  • tests, samples: Refresh the standalone Lab and Telegram hosted-agent sample lockfiles to OAuthlib 4.0.1; Lab remains outside the release batch (#10129, #10128)

Fixed

  • agent-framework-core, agent-framework-foundry-hosting: Scope HTTP headers to each outgoing request so MCP tools, prompts, and Foundry Toolbox resource reads with matching effective headers can overlap while isolating identity changes. Bound admission and recovery with separate request_timeout budgets, not end-to-end deadlines. Caller-owned connection lifecycles remain unchanged; applications must still order state-dependent operations that share server-side MCP session state (#10147)
  • agent-framework-core: Preserve tools supplied by context providers and accept tuple-valued function results (#9403, #9679)
  • agent-framework-core: Preserve termination results through agent and chat middleware, sort function-schema properties deterministically for prompt caching, and accept whole-number floats for JSON Schema integer parameters (#9681, #8960, #9852)
  • agent-framework-core: Honor serialization exclusions for chat-client additional properties, return an empty output-type list when executor discovery is deferred, and deserialize NoneType request-info values (#9943, #9942, #9998)
  • agent-framework-core: Keep uncovered sessions pending after partial memory consolidation, quarantine unreadable memory state instead of failing every turn, and retain finished background tasks until cleared or released (#9294, #9547, #9387)
  • agent-framework-core: Fail closed on invalid FIDES tool policy and changed invocation authority, defer hidden-value materialization until policy approval, and preserve lone Unicode surrogates in durable state (#9875)
  • agent-framework-ag-ui, agent-framework-core: Preserve citations through client and agent streaming and response aggregation (#9094)
  • agent-framework-ag-ui: Emit one start event for each replayed declaration-only tool call (#9770)
  • agent-framework-anthropic: Include cache tokens in input usage and surface streamed citation annotations with character-location document titles (#9859, #9898)
  • agent-framework-anthropic: Serialize hosted MCP tool-result content for replay and preserve redacted_thinking blocks in tool loops (#9972, #10106)
  • agent-framework-azure-cosmos, agent-framework-mongodb, agent-framework-oracle, agent-framework-postgres, agent-framework-qdrant, agent-framework-redis: Prefer injected storage clients over ambient connection settings without taking ownership of caller resources (#9996, #9982, #9985, #9983, #9993, #9977)
  • agent-framework-bedrock: Preserve parallel tool results and prefer explicit boto3 session or injected-client regions over BEDROCK_REGION (#9796, #9967)
  • agent-framework-claude, agent-framework-gemini: Skip connection-setting resolution when the caller supplies an SDK client (#9984, #9969)
  • agent-framework-declarative: Pass extra model configuration through regular request options (#10005)
  • agent-framework-devui: Accept IPv6 loopback Host headers when bound to loopback (#9712)
  • agent-framework-foundry: Attach reasoning replay data to its owning message, sanitize nested SDK models in hosted tools, honor FOUNDRY_MODEL in evaluation, and accept injected embedding clients without endpoint settings (#9931, #9789, #9981, #9991)
  • agent-framework-foundry-hosting: Preserve request metadata in hosted responses (#9745)
  • agent-framework-github-copilot: Reject unsupported function middleware and sum streamed usage across model calls (#10090, #10088)
  • agent-framework-github-copilot: Narrow bare PermissionDecisionApproveForSession() decisions for URL prompts to one-time approval instead of inferring a hostname scope. Supply an explicit domain= for intentional session-scoped URL access; explicit scopes and structured tool approvals remain unchanged (#10149)
  • agent-framework-hosting-mcp: Validate agent MCP tool arguments before invocation (#10036)
  • agent-framework-hyperlight, agent-framework-monty: Deduplicate CodeAct FIDES compatibility warnings (#9788)
  • agent-framework-ollama: Report the correct streaming finish reason for tool calls (#9763)
  • agent-framework-openai: Prefer an injected Azure OpenAI deployment over environment model aliases (#9987)
  • agent-framework-core, agent-framework-openai: Complete empty local shell calls without orphaning history and preserve their local results during service-side continuation (#9803)
  • agent-framework-tools: Terminate the shell process group on stateless shell timeouts (#9483)
Check out latest releases or
releases around microsoft/agent-framework python-1.25.0

Don't miss a new agent-framework release

NewReleases is sending notifications on new releases.

Get notifications