Microsoft Agent Framework — python-1.20.0 release

What it claims

This is five Python releases (1.16.0 on 2026-08-27 through 1.20.0 on 2026-10-02, roughly weekly) and five .NET releases (1.19.0–1.23.0). The summary lists the themes. What it leaves out is the upgrade cost: about a dozen changes are marked [BREAKING], several defaults now fail closed, Python-version and dependency floors have moved, and some approval-bypass and data-leak bugs were fixed. Anyone pinned below python-1.18 or dotnet-1.21 should read the breaking list below before bumping.

How to use it

Python breaking changes, by release

• 1.17
• Agent middleware inputs are sequence-only again.
• The experimental agent-hooks core extra is removed.
• 1.18
• Lab is removed from core[all] and has isolated dependency resolution.
• SecretString is now a masked wrapper, not a str subclass. This affects credential handling in Anthropic, Azure AI Search, Cosmos, Bedrock, Copilot Studio, Foundry, Gemini, Mem0 and OpenAI.
• GitHub Copilot workspace file hooks are now opt-in via enable_file_hooks.
• foundry-hosting (beta) restricts checkpoint deserialization by default. Applications must register any extra checkpoint types.
• Ranged file reads move the line-numbering contract onto AgentFileStore (experimental).
• File, memory, session and skill path normalization is centralized.
• 1.19
• HTTP cookie persistence must now be explicit (a2a, ag-ui, core, declarative).
• MCP skill archives are ZIP-only, and the MCP sampling callback is deprecated.
• Declarative MCP sessions are scoped per invocation.
• Redis history keys are scoped by provider and session identity (beta). Existing stored history keys will differ.
• 1.20
• Foundry hosting is redesigned (request-scoped factories, sandbox-isolated sessions, durable Invocations).
• Declarative workflow state lookup and PowerFx bounding change (experimental).
• Gemini moves to the GOOGLE_* settings namespace and adds Gemini Embedding 2.

Python behavior changes not marked breaking

• Approvals now fail closed when bindings or agent-tool approvals can't be resolved.
• Local approvals must be session-backed.
• Matched function results are treated as terminal.
• Tool diagnostics are internal by default (1.19).
• FunctionInvocationContext injection for skill scripts is opt-in.

Python dependency and runtime support

Vector-store maturity. The page labels the MongoDB, Azure DocumentDB, Qdrant and PostgreSQL/pgvector connectors alpha. It gives no maturity label for DuckDB or SQL Server. The summary does not mention the Redis HASH/JSON stores, the in-memory store, or the shared portable-filter abstractions; all were added in 1.18.

.NET breaking changes

• 1.23
• Azure.AI.Projects 3.0.0-beta.3, OpenAI 2.14.0, MEAI 10.10.1.
• Configuration keys now use an allow list.
• Approval response binding is enforced consistently.
• DevUI approval continuation changes.
• Tool changes between runs are handled differently.
• AGUI SDK packages are now 1.0.0.
• 1.22
• AgentSessionStore is promoted into Agents.AI.Abstractions (preview).
• Approval binding is required for replay.
• MCP sessions are scoped per invocation.
• Foundry delegated user identity is sticky on AgentSession.
• New AsIChatClient extension exposes an AIAgent as an IChatClient.
• 1.21
• The Azure.AI.OpenAI dependency is removed.
• AWSSDK.Extensions.Bedrock.MEAI is replaced by AWS.Bedrock.MEAI.
• file_access_read_lines is added.
• A2A run modes are clarified.
• The LocalCodeAct subprocess environment is isolated.
• 1.19
• MCP long-running tasks migrate to the 2026-07-28 Tasks extension.

Security-relevant fixes

These argue for upgrading rather than staying pinned:

• .NET 1.23 (#8403): the invoke-function tool could bypass approval.
• Python 1.20 (#8972): MCP security labels are now applied before dynamically discovered tools become callable.
• .NET 1.21 (#8164): headers are no longer forwarded on redirect. The OpenAI hosting store is scoped by isolation key.
• Python 1.19 / .NET 1.21–1.22:
• MCP skill archive digests are verified.
• MCP requests and sessions are scoped to the invocation's identity and origin.
• Skill paths are revalidated before use.
• Hosted session key boundaries are preserved.

Limits

• The fetched text is truncated partway through the python-1.20, 1.19 and 1.18 "Fixed" sections, so those fix lists are incomplete.
• The .NET notes are auto-generated commit and PR lists with no migration guidance.
• Some CI checks were disabled when these releases were cut:
• OpenAI integration tests were temporarily skipped because "the CI API key is invalid" (#8767, dotnet-1.23).
• A flaky steering-harness session-reuse test was skipped (#8377, dotnet-1.22).
• Several breaking changes affect packages labeled beta or experimental (foundry-hosting checkpoints, Redis history, declarative, file store). Expect further churn there.