[dependabot]

Bumps agent-framework-core from 1.18.0 to 1.19.0.

Release notes

Sourced from agent-framework-core's releases.

python-1.19.0

[1.19.0] - 2026-09-18

Added

• agent-framework, agent-framework-core: Add generic vector-store provider protocols, instrumentation message-event controls, and per-tool AgentModeProvider exposure controls (#8421, #8451, #8450)
• agent-framework-mongodb: Add the alpha MongoDB vector-store connector (#8184)
• agent-framework-azure-documentdb: Add the alpha Azure DocumentDB vector-store connector (#8185)
• agent-framework-azure-cosmos, agent-framework-core: Add an Azure Cosmos DB NoSQL implementation of the shared vector-store APIs (#8186)
• agent-framework-orchestrations: Add stable names for built-in orchestration workflows and register their checkpoint types for restoration (#8384, #8258)
• agent-framework-devui: Display Aspire traces in the developer UI (#7874)
• agent-framework-core: Add an option to invoke function calls sequentially (#8453)
• agent-framework-core, agent-framework-hyperlight, agent-framework-monty: Expose CodeAct tool parameter schemas and configurable compact or JSON descriptions (#8459)

Changed

• agent-framework-a2a, agent-framework-ag-ui, agent-framework-core, agent-framework-declarative: [BREAKING] Make HTTP cookie persistence explicit for framework-owned and caller-owned clients (#8371)
• agent-framework-core: [BREAKING] Limit MCP skill archives to ZIP files and deprecate the MCP sampling callback (#8290, #8401)
• agent-framework-declarative: [BREAKING] Scope provider-backed MCP sessions per invocation (#8425)
• agent-framework-redis: [BREAKING - beta] Scope history storage keys by provider and session identity (#8236)
• agent-framework-core: Refine skill frontmatter parsing, propagate runtime arguments to skill callbacks, and clarify MCP annotation override behavior (#8430, #8387, #8399)
• agent-framework-core, agent-framework-hosting-a2a: Tighten security-label enforcement and restrict owned-input argument labels (#8238, #8394)
• agent-framework-purview: Handle additional content types during Purview policy processing (#8370)
• agent-framework-mistral, agent-framework-hosting-responses: Reject unsupported per-call Mistral transport options (#8392)
• agent-framework-monty: Update the Monty bridge for the current pydantic-monty pool API and reuse registered tools in callbacks (#8152, #8395)
• agent-framework-openai: Separate hosted and local shell calls (#8294)
• agent-framework-ag-ui, agent-framework-anthropic, agent-framework-bedrock, agent-framework-core, agent-framework-foundry-hosting, agent-framework-hosting-a2a, agent-framework-hosting-mcp, agent-framework-hosting-responses, agent-framework-openai: Keep tool diagnostics internal by default (#8235)
• agent-framework-azure-cosmos: Clarify Cosmos history-provider storage scope (#8391)
• tests: Add public API compatibility checks and update root and Lab development dependencies and lockfiles (#8271, #8469, #8266, #8470, #8249, #8471, #8472, #8473)
• docs: Document keyed web search through the Serply MCP server and correct Python documentation wording (#8319, #8323)

Fixed

• agent-framework-core: Preserve function-call and approval context across mixed batches, resumed runs, nested workflows, and streaming merges (#8428, #8433, #8345, #8337)
• agent-framework-core: Preserve compaction summaries and configuration while excluding encrypted reasoning payloads from token counts (#8354, #8329, #8117, #7944)
• agent-framework-core: Make file checkpoint saves, deletion, encoding, and round trips concurrency-safe and lossless (#7757, #8261, #8272, #8262, #8181)
• agent-framework-core: Preserve workflow streaming, response metadata, state, return types, and invocation keyword arguments across completion and resume paths (#8231, #8389, #8300, #8309, #8311, #7999, #8287, #8331)
• agent-framework-core: Authenticate and scope MCP requests and sessions to the correct invocation identity, origin, and ownership (#8303, #8285, #8246, #8225)
• agent-framework-core: Verify MCP skill archive digests, avoid duplicate structured content, and reject ambiguous MCP configuration matches (#8404, #8274, #8386)
• agent-framework-core: Propagate result-parser and asynchronous tool invocation failures correctly and count async invocation exceptions (#8420, #8278)
• agent-framework-core: Avoid OpenTelemetry context detach errors and record failed client-operation durations (#8398, #8347)
• agent-framework-core: Preserve instruction ordering, support Literal annotations, allow middleware argument repair, and deduplicate MessagePack history writes (#8353, #8351, #8288, #8224)
• agent-framework-core: Bound stateless approval pause batches to the current user turn (#8449)
• agent-framework-ag-ui, agent-framework-core, agent-framework-foundry: Preserve checkpoint, approval, replay, reasoning, and session metadata across AG-UI interrupts and resumes (#8163, #8373, #8058, #8149, #8279, #8199)
• agent-framework-anthropic, agent-framework-core: Isolate Anthropic request parsing state and handle provider-invalidated responses (#8237, #8396)
• agent-framework-declarative: Keep internal workflow-routing arguments out of agent calls, preserve message values, and load YAML paths portably (#8435, #8366, #8260)
• agent-framework-foundry-hosting: Preserve compaction responses, isolate test state, parallelize storage reads, and maintain hosted session boundaries (#8117, #8409, #8363, #8263)
• agent-framework-openai: Preserve image-generation results, hosted function outputs, content-filter details, reasoning content, continuation state, and streamed tool-call identity (#8424, #8078, #8393, #8405, #8358, #8337)
• agent-framework-orchestrations: Preserve agent configuration and workflow run arguments across handoff and group-chat orchestration (#8329, #8312)
• agent-framework-azure-cosmos: Preserve replayed history and support the current Cosmos SDK query result shape (#8269)
• agent-framework-azure-cosmos-memory: Support the current Cosmos memory retrieval result shape (#8460)
• agent-framework-qdrant: Handle the collection-readiness race after concurrent creation (#8381)
• agent-framework-hyperlight: Clean generated output files after execution (#8230, #8380)

... (truncated)

Commits

• d9d3fb6 .NET: Update version for 1.19.0 release (#7814)
• abe1f62 .NET: Add support for Resilient long-running and Steerable Foundry Hosted Age...
• 7a2b803 [BREAKING] Python: Bump package versions for 1.15.0 release (#7812)
• 65e8aff Fix DevFlow review command whitespace handling (#7813)
• c6a0e90 Python: correct MCP tool argument filtering documentation (#7801)
• 7b7b9a1 Python: Foundry Hosted Agent Resiliency Support (#7670)
• eb8548e Docs: add Go to the main README (#7754)
• ede605d .NET: Bump AgentMemory from 1.3.0 to 1.4.1 (#7639)
• eccf471 .NET: Fix ReasoningSummary passthrough in GitHub Copilot resume config (#6441)
• 6a58888 Python: Bump uv from 0.11.32 to 0.12.5 in /python (#7780)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[dependabot]

Looks like agent-framework-core is up-to-date now, so this is no longer needed.