This release includes 1 security fix for security teams reviewing exposed deployments.
Published 19d
AI Agents & Assistants
✓ No known CVEs patched
This release patches 1 known CVE
Topics
ai
artificial-intelligence
llm
openai
sdk
Affected surfaces
deps
breaking_upgrade
Summary
AI summary[Breaking] Update runtime handling
Full changelog
What's Changed
- Python: Bump tornado from 6.5.5 to 6.5.7 in /python by @dependabot[bot] in https://github.com/microsoft/semantic-kernel/pull/14090
- Python: Bump pyjwt from 2.11.0 to 2.13.0 in /python by @dependabot[bot] in https://github.com/microsoft/semantic-kernel/pull/14084
- Python: Bump starlette from 0.52.1 to 1.3.1 in /python by @dependabot[bot] in https://github.com/microsoft/semantic-kernel/pull/14092
- Python: Update pymongo requirement from <4.16,>=4.8.0 to >=4.8.0,<4.17 in /python by @dependabot[bot] in https://github.com/microsoft/semantic-kernel/pull/13866
- Python: Bump bleach from 6.3.0 to 6.4.0 in /python by @dependabot[bot] in https://github.com/microsoft/semantic-kernel/pull/14089
- Bump pyarrow from 21.0.0 to 23.0.1 in /python by @dependabot[bot] in https://github.com/microsoft/semantic-kernel/pull/14058
- Python: Bump torch from 2.8.0 to 2.12.0 in /python by @dependabot[bot] in https://github.com/microsoft/semantic-kernel/pull/14065
- Python: Bump idna from 3.11 to 3.15 in /python by @dependabot[bot] in https://github.com/microsoft/semantic-kernel/pull/14024
- Bump urllib3 from 2.6.3 to 2.7.0 in /python by @dependabot[bot] in https://github.com/microsoft/semantic-kernel/pull/13978
- Python: Bump authlib from 1.6.11 to 1.6.12 in /python by @dependabot[bot] in https://github.com/microsoft/semantic-kernel/pull/14004
- Bump mistune from 3.2.0 to 3.2.1 in /python by @dependabot[bot] in https://github.com/microsoft/semantic-kernel/pull/13965
- Python: Add OpenAPI server URL validation by @eavanvalkenburg in https://github.com/microsoft/semantic-kernel/pull/14097
- Python: Adjust request validation by @SergeyMenshykh in https://github.com/microsoft/semantic-kernel/pull/14114
- Bump axios from 1.13.2 to 1.16.0 in /dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.ReactFrontend by @dependabot[bot] in https://github.com/microsoft/semantic-kernel/pull/14044
- Python: Enforce excluded_functions on MCP tool invocation path by @SergeyMenshykh in https://github.com/microsoft/semantic-kernel/pull/14124
- Python: Default MCP SSE server samples to loopback with host validation by @SergeyMenshykh in https://github.com/microsoft/semantic-kernel/pull/14127
- Bump Scriban from 7.2.0 to 7.2.5 to fix NU1902 vulnerability by @SergeyMenshykh in https://github.com/microsoft/semantic-kernel/pull/14133
- Python: OpenApi: Harden operation path handling for consistent selection and request targeting (.Net & Python) by @rogerbarreto in https://github.com/microsoft/semantic-kernel/pull/14140
- Python: [Breaking] Update runtime handling by @SergeyMenshykh in https://github.com/microsoft/semantic-kernel/pull/14135
- Python: Bump Python version to 1.44.0 for a release by @moonbox3 in https://github.com/microsoft/semantic-kernel/pull/14141
Full Changelog: https://github.com/microsoft/semantic-kernel/compare/python-1.43.1...python-1.44.0
Breaking Changes
- Update runtime handling – a breaking change in behavior
Security Fixes
- Scriban bumped to 7.2.5 to fix NU1902 vulnerability
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About semantic-kernel
Integrate cutting-edge LLM technology quickly and easily into your apps
Related context
Related tools
Earlier breaking changes
- vpython-1.43.0 Updates OpenAPI document parsing options in Python.
Beta — feedback welcome: [email protected]