New functionality: AI with Splunk Apps

This release enables integrating LLMs with Splunk Apps.
We worked ourselves to the bone to implement this functionality the best we could and are very excited to see what you build with it!

Take a look at ai/README.md to learn more about it.

What's Changed

• Bump actions/setup-python from 9322b3ca74000aeb2c01eb777b646334015ddd72 to 65b071217a8539818fdb8b54561bcbae40380a54 by @dependabot[bot] in #654
• Always call sleep while restarting by @mateusz834 in #649
• Add space before username in restart required message by @mateusz834 in #655
• Bump actions/setup-python from 65b071217a8539818fdb8b54561bcbae40380a54 to 3d1e2d2ca0a067f27da6fec484fce7f5256def85 by @dependabot[bot] in #657
• Test using macros directly in an SPL query by @mateusz834 in #658
• Add tests for macro permissions by @mateusz834 in #659
• Modernize project to use pyproject.toml, review .gitignore and untrack any ignored files, update README by @Ickerday in #660
• Update version to 2.2.0 alpha, fix Trusted Publishing by @Ickerday in #663
• Bump actions/setup-python from 3d1e2d2ca0a067f27da6fec484fce7f5256def85 to e797f83bcb11b83ae66e0230d6156d7c80228e7c by @dependabot[bot] in #666
• Bump pypa/gh-action-pypi-publish from d417ba7e7683fa9104c42abe611c1f2c93c0727d to ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e by @dependabot[bot] in #665
• Give Splunk some more time after a restart by @mateusz834 in #668
• Resolve warnings emitted by tests by @mateusz834 in #667
• Document key_file, cert_file, context params. by @mateusz834 in #672
• Don't specify Host header explicitly by @mateusz834 in #673
• SDK-21 add deps of test apps into bin/ by @cecyliaborek in #671
• Remove ResultsReader, six by @Ickerday in #670
• Replace tox with pytest and Makefile, cleanup in docs/Makefile by @Ickerday in #669
• Bump actions/upload-artifact from de65e23aa2b7e23d713bb51fbfcb6d502f8667d8 to 2848b2cda0e5190984587ec6bb1f36730ca78d50 by @dependabot[bot] in #676
• Support self.service in ModularInput's validate_input by @mateusz834 in #682
• Expose published and author fields by @mateusz834 in #681
• Deflake test_published_author_fields by @mateusz834 in #684
• Bump actions/checkout from ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 to 71cf2267d89c5cb81562390fa70a37fa40b1305e by @dependabot[bot] in #686
• Bump actions/upload-artifact from 2848b2cda0e5190984587ec6bb1f36730ca78d50 to 330a01c490aca151604b8cf639adc76d48f6c5d4 by @dependabot[bot] in #680
• Support setting string body in the generic request method by @mateusz834 in #683
• Bump actions/setup-python from 6.0.0 to 6.1.0 by @dependabot[bot] in #689
• Add patch and put methods to the service by @mateusz834 in #693
• Bump actions/checkout from 6.pre.beta to 6.0.2 by @dependabot[bot] in #696
• Bump actions/setup-python from 6.1.0 to 6.2.0 by @dependabot[bot] in #697
• Adjust top-level comments in all files by @Ickerday in #699
• Fix test_list_with_sort_dir by @mateusz834 in #703
• Support all ML-KEM key exchange algorithms by @mateusz834 in #702
• Deprecate the encr_password field from storage/passwords by @Ickerday in #695
• Bump actions/upload-artifact from 5.0.0 to 7.0.0 by @dependabot[bot] in #700
• Add Python scans to Dependabot by @Ickerday in #707
• Upstream updates to some workflows by @Ickerday in #708
• Remove Fossa by @Ickerday in #709
• Merge develop to develop-3.0 by @mateusz834 in #716
• Reverse-merge develop-3.0 into develop by @Ickerday in #714
• Bump packages in pyproject.toml by @Ickerday in #725
• Change ToolResult.content to str by @mateusz834 in #723
• Restrict subagent names by @mateusz834 in #722
• Fix splunklib/ai/README.md by @szykol in #728
• Turn off Dependabot for the time being by @Ickerday in #735
• Add FOSSA badge to README by @Ickerday in #736
• Add AppInspect CI stage by @Ickerday in #730
• Fix MCP Server App download script by @Ickerday in #739
• Change AgentState.response to AgentState.messages by @splunk-dtaborski in #743
• Snapshot record then reply testing by @mateusz834 in #740
• Improve handling AIMessage.content by @szykol in #741
• Make id required (non-nullable) for tool/subagent/output calls by @mateusz834 in #724
• Uncomment dependabot config by @Ickerday in #745
• Group dependabot updates by @Ickerday in #752
• Disallow running Agents using system user by @szykol in #753
• Explicitly set type in every LC_ToolCall by @mateusz834 in #760
• Set kw_only=True in all dataclasses by @mateusz834 in #758
• Add thread_id to middlewares by @mateusz834 in #755
• Use keyed parameters in SubagentTextResult constructor by @mateusz834 in #763
• test: Pass fake api_key to the internal ai model by @szykol in #764
• Prepare for Beta release by @Ickerday in #731
• Add StructuredOutputRetryLimitMiddleware and default retry limit by @mateusz834 in #756
• Use thread_ids in TimeoutLimitMiddleware by @mateusz834 in #757
• Move limit middlewares from splunklib.ai.hooks to splunklib.ai.limits by @mateusz834 in #759
• Add GoogleModel support by @szykol in #727
• Make sure default middlewares are always ordered in the same order by @mateusz834 in #766
• Run ruff format on repo by @Ickerday in #744
• CD adjustments again by @Ickerday in #767
• Remove commit SHA from the version pushed to Test PyPI by @Ickerday in #772
• CD adjustments again, again by @Ickerday in #774
• Make limits as settings instead of implicit middlewares by @mateusz834 in #769
• Remove total_steps and token_count from AgentState by @mateusz834 in #770
• Add test for SystemMessage by @mateusz834 in #775
• Fix Fossa badge in README by @Ickerday in #776
• Introduce validating version field against git tag by @Ickerday in #779
• Minor release adjustments by @Ickerday in #781
• Fix wrong braces in release step by @Ickerday in #783
• Fix wrong API endpoint for official PyPI by @Ickerday in #784

New Contributors

• @dependabot[bot] made their first contribution in #654
• @szykol made their first contribution in #728
• @splunk-dtaborski made their first contribution in #743

Full Changelog: 2.1.1...3.0.0