This release includes 3 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+4 more
Affected surfaces
Summary
AI summary[BREAKING] Add sampling guardrails to MCP tools, deny server‑initiated sampling by default and introduce new sampling parameters.
Full changelog
[1.9.0] - 2026-06-18
Added
- agent-framework-core: Add
AgentLoopMiddlewarefor re-running agents in a loop (#6174) - agent-framework-core: Integrate tool approval into the harness agent (#6522)
- agent-framework-core: Add tool approval middleware (#6414)
- agent-framework-core: Integrate the shell tool into the harness agent (#6451)
- agent-framework-core: Capture context provider instructions in agent telemetry (#6515)
- agent-framework-core, agent-framework-ag-ui: Add opt-in AG-UI thread snapshot persistence and hydration (#6471)
- agent-framework-foundry-hosting: Emit failed events for hosted agent responses (#6502)
Changed
- agent-framework-core: [BREAKING] Add sampling guardrails to MCP tools — deny server-initiated sampling by default and add
sampling_approval_callback,sampling_max_tokens, andsampling_max_requestsparameters (#6413) - agent-framework-core: [BREAKING] Align FileAccess tools with .NET, adding directory discovery and recursive search (#6476)
- agent-framework-declarative: [BREAKING] Additional fixes for declarative workflow execution (#6489)
- agent-framework-azure-contentunderstanding: Adopt
azure-ai-contentunderstandingto_llm_inputin the CU context provider (#5796) - agent-framework-orchestrations: Promote to stable (
1.0.0)
Fixed
- agent-framework-core: Stop forwarding the unsupported
function_invocation_configurationkwarg fromas_agent(#6520) - agent-framework-core: Fix MCP
allowed_toolsempty-list handling (#6296) - agent-framework-core: Disable harness compaction when max tokens are not provided (#6410)
- agent-framework-core: Parse MCP
CallToolResult.structuredContentto prevent tool results returningNone(#6421) - agent-framework-core: Catch bare
ImportErrorduring hosted-environment detection so optional Foundry hosting probing cannot crash user-agent setup - agent-framework-anthropic, agent-framework-core, agent-framework-openai: Fix OTel usage detail attributes (#6493)
- agent-framework-foundry, agent-framework-openai: Fix Azure AI Search citation URLs (#6453)
- agent-framework-foundry: Fix
aiohttpdependency specification (#6567) - agent-framework-declarative: Fix declarative workflow execution (#6468)
- samples: Fix harness console rendering a single streamed tool call multiple times (#6549)
- samples: Fix
ollama_chat_client.pyto pass tools via the options dict (#6480)
Full Changelog: https://github.com/microsoft/agent-framework/compare/python-1.8.1...python-1.9.0
Breaking Changes
- [BREAKING] Add sampling guardrails to MCP tools — deny server‑initiated sampling by default and add `sampling_approval_callback`, `sampling_max_tokens`, and `sampling_max_requests` parameters
- [BREAKING] Align FileAccess tools with .NET, adding directory discovery and recursive search
- [BREAKING] Additional fixes for declarative workflow execution
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About agent-framework
A framework for building, orchestrating and deploying AI agents and multi-agent workflows with support for Python and .NET.
Related context
Related tools
Earlier breaking changes
- vpython-1.8.0 [BREAKING — experimental] Refactor Skill API to async resource and script lookup
- vpython-1.8.0 [BREAKING] Upgrade github-copilot-sdk to v1.0.0 (stable)
- vdotnet-1.9.0 Removes [Experimental] tag from .NET Orchestrations, marking them stable.
- vpython-1.7.0 Remove Python-only declarative actions and rename alias kinds to C# canonical names in agent-framework-declarative.
- vpython-1.6.0 Enable instrumentation by default in agent-framework-core and agent-framework-foundry.
Beta — feedback welcome: [email protected]