Release: merge main into alpha/v2.0.0#377
Merged
lilyydu merged 18 commits intoalpha/v2.0.0from Apr 9, 2026
Merged
Conversation
- The post-processing script in the issue analysis workflow extracts the last block of plain text from copilot output - Without explicit instruction, the agent sometimes ends with meta-commentary (e.g. "My action plan above is complete") instead of the actual plan - Added a prompt instruction requiring the agent's final message to be the complete action plan in markdown --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…ageUpdateActivity (#349) resolves: #326 and #347 - added default empty string for `text` in `MessageUpdateActivity` (otherwise throws pydantic error) - added support for custom feedback form (through `ChannelData.feedback_loop`). **Custom Feedback Context:** [Learn Doc](https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/bot-messages-ai-generated-content?tabs=desktop%2Cjs%2Cbotmessage#feedback-buttons) - previously we had a flag called `enable_feedback_loop` which **only** enables the default feedback form - now, we have a param called `feedback_loop` that can either be default or custom. - however, the service doesn't accept both at once. Hence I normalized `enable_feedback_loop` into `feedback_loop`. whenever `enable_feedback_loop` is set to True, it'll set `feedback_loop` to default and itself back to `None`. <img width="659" height="426" alt="image" src="https://github.com/user-attachments/assets/a2a38486-e853-4fb1-b6c5-72da5264f00c" /> **Example Usage:** ``` @app.on_message async def on_message(ctx: ActivityContext[MessageActivity]): if ctx.activity.text == "feedback default": # This is the legacy approach that normalizes. Recommended to use `feedback_loop` instead. await ctx.send( MessageActivityInput(text="Rate this response!").with_channel_data(ChannelData(feedback_loop_enabled=True)) ) elif ctx.activity.text == "feedback custom": await ctx.send( MessageActivityInput(text="Rate this response!").add_feedback( mode="custom" ) # triggers message/fetchTask invoke ) @app.on_message_fetch_task async def on_feedback_fetch_task(ctx: ActivityContext[MessageFetchTaskInvokeActivity]): card = AdaptiveCard.model_validate( { "type": "AdaptiveCard", "version": "1.4", "body": [ {"type": "TextBlock", "text": "Tell us more about your feedback:"}, { "type": "Input.Text", "id": "feedbackText", "placeholder": "Enter your feedback here...", "isMultiline": True, }, ], "actions": [ {"type": "Action.Submit", "title": "Submit"}, ], } ) return TaskModuleInvokeResponse( task=TaskModuleContinueResponse( value=CardTaskModuleTaskInfo( title="Feedback", card=card_attachment(AdaptiveCardAttachment(content=card)), ) ) ) ``` --------- Co-authored-by: lilydu <lilydu+odspmdb@microsoft.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
## Summary Fixes #338. removed: - `ConversationUpdateActivityInput` - invalid outbound activity that fails service validation - inbound and outbound `HandoffActivity` - not recognized by backend - BF has a similar event but it uses `type: "event"` + `name: "handoff.initiate"` - similiarly exists for copilot but it is only inbound as `HandoffActionInvokeActivity` which we have - inbound and outbound `TraceActivity` - not recognized by backend - is only for the BF Emulator which is now deprecated. [doc ref](https://learn.microsoft.com/en-us/azure/bot-service/using-trace-activities?view=azure-bot-service-4.0&tabs=csharp) - `MessageDeleteActivityInput` - invalid outbound activity that fails service validation - will be provided in a new API endpoint instead - `MessageUpdateActivityInput` - invalid outbound activity that fails service validation - `CommandSendActivityInput` - invalid outbound activity that fails service validation - not a Teams concept. it's a BF activity type used in the skills protocol — where one bot sends a command to a skill bot and gets a commandResult back. - `CommandResultActivityInput` - not recognized by backend - not a Teams concept, it's a BF skill that sends back to the parent bot after completing a command. --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: lilydu <lilydu+odspmdb@microsoft.com>
- only outbound activities we have are `MessageActivityInput` and `TypingActivityInput` - basically same as #231, moved citations, feedback, AI label --------- Co-authored-by: lilydu <lilydu+odspmdb@microsoft.com>
## Summary - Regenerated core.py from latest AC schema codegen output - New types: CollabStageInvokeDataValue, OpenUrlDialogAction, PopoverAction, ProgressBar, ProgressRing, Resources, StringResource, TabInfo ## Test plan - [x] 9/9 cards tests pass on updated main - [x] Lint passes (ruff format + ruff check) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.4.1 to 6.4.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>v6.4.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted -->6.4.2 (2026-04-06)<!-- raw HTML omitted --></h2> <ul> <li>fix: apply server.fs check to env transport (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22159">#22159</a>) (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22163">#22163</a>) (<a href="https://github.com/vitejs/vite/commit/fe28e47e9463e4c9619f94bfa06d2f8f1411b44b">fe28e47</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/22159">#22159</a> <a href="https://redirect.github.com/vitejs/vite/issues/22163">#22163</a></li> <li>fix: avoid path traversal with optimize deps sourcemap handler (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22161">#22161</a>) (<a href="https://github.com/vitejs/vite/commit/ca4da5d1fb45c9cfdce606aa30825095791b164b">ca4da5d</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/22161">#22161</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/6b3fad02abd550bd7b79934ff92c58dbd7f33045"><code>6b3fad0</code></a> release: v6.4.2</li> <li><a href="https://github.com/vitejs/vite/commit/ca4da5d1fb45c9cfdce606aa30825095791b164b"><code>ca4da5d</code></a> fix: avoid path traversal with optimize deps sourcemap handler (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22161">#22161</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/fe28e47e9463e4c9619f94bfa06d2f8f1411b44b"><code>fe28e47</code></a> fix: apply server.fs check to env transport (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22159">#22159</a>) (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22163">#22163</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/5487f4f641f70c47ea05fd101a4319897df048b3"><code>5487f4f</code></a> release: v6.4.1</li> <li><a href="https://github.com/vitejs/vite/commit/1114b5d7ea03e26572708715343bec69db4536e8"><code>1114b5d</code></a> fix(dev): trim trailing slash before <code>server.fs.deny</code> check (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20968">#20968</a>) (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20969">#20969</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/f12697c0f64b9a37196b9ab218a0911829d5b103"><code>f12697c</code></a> release: v6.4.0</li> <li><a href="https://github.com/vitejs/vite/commit/ca6455ee9eb6111a9caa9810506a1b9ac96a520a"><code>ca6455e</code></a> feat: allow passing down resolved config to vite's createServer (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20932">#20932</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/0e173d83681daa31be10fa8a62d56b1ec84690af"><code>0e173d8</code></a> release: v6.3.7</li> <li><a href="https://github.com/vitejs/vite/commit/c59a222aa584c087cfe710173de1b9ecb597a3ff"><code>c59a222</code></a> fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20940">#20940</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/3f337c5e24504e51188d29c970de1416ee523dbb"><code>3f337c5</code></a> release: v6.3.6</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v6.4.2/packages/vite">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/teams.py/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Two minor corrections surfaced during review of the `HttpPlugin` / JWT middleware removal PR. - **`.github/copilot-instructions.md`**: Corrects validation path `tests/echo` → `examples/echo`; sample apps live under `examples/`, not `tests/` - **`packages/apps/tests/test_function_context.py`**: Renames `mock_http` fixture docstring from `"Create a mock HTTP server."` to `"Create a mock activity sender."` — the fixture only wires up `.send()`, never an HTTP server --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
- fixed cookiecutter statements referencing tests to examples - moved dev tools in packages into dev dependency group instead of runtime - updated broken code format for graph package README --------- Co-authored-by: lilydu <lilydu+odspmdb@microsoft.com>
Fixes #332 --------- Co-authored-by: Lily Du <lilyyduu@gmail.com> Co-authored-by: heyitsaamir <ajawaid191@gmail.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
`App` had no way to access a Graph client for app-only operations — only `ActivityContext` did. ## Changes - **`App._get_graph_token(tenant_id=None)`** — new private method wrapping `_token_manager.get_graph_token()`, mirroring the existing `_get_bot_token` pattern. - **`App.get_app_graph(tenant_id=None)`** — new public method returning a `GraphServiceClient` for app-only Graph operations. Not cached (clients own caching if needed). Accepts optional `tenant_id` for multi-tenant support. - **`utils/graph.py`** — new utility module with a public `create_graph_client` helper (replaces the private `_get_graph_client` inline function in `activity_context.py`). Both `ActivityContext` and `App` now import it from `utils`. - **`ActivityContext.app_graph`** — unchanged. - **`ActivityProcessor`** — unchanged. ```python # App-level Graph access, no ActivityContext needed graph = app.get_app_graph() # default tenant graph = app.get_app_graph(tenant_id="some-tenant") # explicit tenant me = await graph.me.get() ``` --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: heyitsaamir <48929123+heyitsaamir@users.noreply.github.com> Co-authored-by: heyitsaamir <ajawaid191@gmail.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- dependabot isn't working right now due to nbgv, addressing manually until we merge in a workaround - aiohttp: 3.13.3 -> 3.13.5 - cryptography: 46.0.5 -> 46.0.6 - fastmcp: 3.1.1 -> 3.2.0 - pygments: 2.19.2 -> 2.20.0 - requests: 2.32.5 -> 2.33.1 Co-authored-by: lilydu <lilydu+odspmdb@microsoft.com>
## Summary - Adds `tools/hatch-nbgv/`, a thin hatchling version-source plugin (`nbgv-fallback`) that wraps `nbgv-python` with graceful fallback - When nbgv CLI is available (CI): delegates to `nbgv-python` for real version resolution + PEP 440 normalization - When nbgv CLI is missing (local dev): falls back to `0.0.0` with a warning instead of failing the build - Plugin named `nbgv-fallback` to avoid collision with `nbgv-python`'s own hatch entry point - `NBGV_REQUIRED=1` env var set in both GitHub Actions and AzDO pipelines to prevent publishing `0.0.0` - All 11 packages updated to use `source = "nbgv-fallback"` in `[tool.hatch.version]` ## Test plan - [x] `uv sync` works without nbgv installed (packages resolve to `0.0.0`) - [x] `uv sync` works with nbgv installed (packages resolve to real versions) - [x] `uv build --all-packages` produces correct versions with nbgv - [x] `uv build --all-packages` falls back to `0.0.0` without nbgv - [x] `NBGV_REQUIRED=1 uv build --all-packages` without nbgv → build fails hard - [x] `pytest` — 577 tests pass - [x] `pyright` — 0 errors 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude <noreply@anthropic.com>
Merge conflict - didn't sync uv lock correctly.
Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.6 to 46.0.7. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's changelog</a>.</em></p> <blockquote> <p>46.0.7 - 2026-04-07</p> <pre><code> * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be passed to APIs that accept Python buffers, which could lead to buffer overflow. **CVE-2026-39892** * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6. <p>.. _v46-0-6:<br /> </code></pre></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5"><code>622d672</code></a> 46.0.7 release (<a href="https://redirect.github.com/pyca/cryptography/issues/14602">#14602</a>)</li> <li>See full diff in <a href="https://github.com/pyca/cryptography/compare/46.0.6...46.0.7">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary - Added missing `app-users` and `app-users ctx` commands and app-level Graph access feature - Fixed default port from 3979 to 3978 (matching `main.py`) - Replaced non-existent `run_demo.ps1` and manual PYTHONPATH instructions with `uv run` - Updated example code to show actual patterns used (`ctx.user_token`, `app.get_app_graph()`, `ctx.app_graph`) - Removed outdated sections (manual `GetUserTokenParams` token fetching, verbose Token Lifecycle/Architecture) ## Test plan - [ ] Verify README commands list matches `main.py` handlers - [ ] Confirm `sample.env` port comment matches code default (`3978`) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude <noreply@anthropic.com>
`workflow_dispatch` triggers can be abused to manually invoke workflows with attacker-controlled inputs, expanding the attack surface unnecessarily. ## Changes - **`.github/workflows/issue-analysis.yml`** - Removed `workflow_dispatch` trigger and its `issue_number` input - Dropped the job-level `if` guard that branched on `workflow_dispatch` vs `issues` event - Collapsed the "Resolve issue details" step — removed the `workflow_dispatch` branch that called the GitHub API with a user-supplied issue number, keeping only the direct event-payload path - Removed `EVENT_NAME` and `INPUT_NUMBER` env vars that existed solely to support the dispatch path --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: heyitsaamir <48929123+heyitsaamir@users.noreply.github.com>
Bumps [axios](https://github.com/axios/axios) from 1.13.5 to 1.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v1.15.0</h2> <p>This release delivers two critical security patches, adds runtime support for Deno and Bun, and includes significant CI hardening, documentation improvements, and routine dependency updates.</p> <h2>⚠️ Important Changes</h2> <ul> <li><strong>Deprecation:</strong> <code>url.parse()</code> usage has been replaced to address Node.js deprecation warnings. If you are on a recent version of Node.js, this resolves console warnings you may have been seeing. (<strong><a href="https://redirect.github.com/axios/axios/issues/10625">#10625</a></strong>)</li> </ul> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Proxy Handling:</strong> Fixed a <code>no_proxy</code> hostname normalisation bypass that could lead to Server-Side Request Forgery (SSRF). (<strong><a href="https://redirect.github.com/axios/axios/issues/10661">#10661</a></strong>)</li> <li><strong>Header Injection:</strong> Fixed an unrestricted cloud metadata exfiltration vulnerability via a header injection chain. (<strong><a href="https://redirect.github.com/axios/axios/issues/10660">#10660</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>Runtime Support:</strong> Added compatibility checks and documentation for Deno and Bun environments. (<strong><a href="https://redirect.github.com/axios/axios/issues/10652">#10652</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10653">#10653</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li><strong>CI Security:</strong> Hardened workflow permissions to least privilege, added the <code>zizmor</code> security scanner, pinned action versions, and gated npm publishing with OIDC and environment protection. (<strong><a href="https://redirect.github.com/axios/axios/issues/10618">#10618</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10619">#10619</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10627">#10627</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10637">#10637</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10666">#10666</a></strong>)</li> <li><strong>Dependencies:</strong> Bumped <code>serialize-javascript</code>, <code>handlebars</code>, <code>picomatch</code>, <code>vite</code>, and <code>denoland/setup-deno</code> to latest versions. Added a 7-day Dependabot cooldown period. (<strong><a href="https://redirect.github.com/axios/axios/issues/10574">#10574</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10572">#10572</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10568">#10568</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10663">#10663</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10664">#10664</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10665">#10665</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10669">#10669</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10670">#10670</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10616">#10616</a></strong>)</li> <li><strong>Documentation:</strong> Unified docs, improved <code>beforeRedirect</code> credential leakage example, clarified <code>withCredentials</code>/<code>withXSRFToken</code> behaviour, HTTP/2 support notes, async/await timeout error handling, header case preservation, and various typo fixes. (<strong><a href="https://redirect.github.com/axios/axios/issues/10649">#10649</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10624">#10624</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7452">#7452</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/7471">#7471</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10654">#10654</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10644">#10644</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10589">#10589</a></strong>)</li> <li><strong>Housekeeping:</strong> Removed stale files, regenerated lockfile, and updated sponsor scripts and blocks. (<strong><a href="https://redirect.github.com/axios/axios/issues/10584">#10584</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10650">#10650</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10582">#10582</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10640">#10640</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10659">#10659</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10668">#10668</a></strong>)</li> <li><strong>Tests:</strong> Added regression coverage for urlencoded <code>Content-Type</code> casing. (<strong><a href="https://redirect.github.com/axios/axios/issues/10573">#10573</a></strong>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve Axios:</p> <ul> <li><strong><a href="https://github.com/raashish1601"><code>@raashish1601</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10573">#10573</a></strong>)</li> <li><strong><a href="https://github.com/Kilros0817"><code>@Kilros0817</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10625">#10625</a></strong>)</li> <li><strong><a href="https://github.com/ashstrc"><code>@ashstrc</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10624">#10624</a></strong>)</li> <li><strong><a href="https://github.com/Abhi3975"><code>@Abhi3975</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10589">#10589</a></strong>)</li> <li><strong><a href="https://github.com/theamodhshetty"><code>@theamodhshetty</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/7452">#7452</a></strong>)</li> </ul> <h2>v1.14.0</h2> <p>This release focuses on compatibility fixes, adapter stability improvements, and test/tooling modernisation.</p> <h2>⚠️ Important Changes</h2> <ul> <li><strong>Breaking Changes:</strong> None identified in this release.</li> <li><strong>Action Required:</strong> If you rely on env-based proxy behaviour or CJS resolution edge-cases, validate your integration after upgrade (notably <code>proxy-from-env</code> v2 alignment and <code>main</code> entry compatibility fix).</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>Runtime Features:</strong> No new end-user features were introduced in this release.</li> <li><strong>Test Coverage Expansion:</strong> Added broader smoke/module test coverage for CJS and ESM package usage. (<a href="https://redirect.github.com/axios/axios/pull/7510">#7510</a>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Headers:</strong> Trim trailing CRLF in normalised header values. (<a href="https://redirect.github.com/axios/axios/pull/7456">#7456</a>)</li> <li><strong>HTTP/2:</strong> Close detached HTTP/2 sessions on timeout to avoid lingering sessions. (<a href="https://redirect.github.com/axios/axios/pull/7457">#7457</a>)</li> <li><strong>Fetch Adapter:</strong> Cancel <code>ReadableStream</code> created during request-stream capability probing to prevent async resource leaks. (<a href="https://redirect.github.com/axios/axios/pull/7515">#7515</a>)</li> <li><strong>Proxy Handling:</strong> Fixed env proxy behavior with <code>proxy-from-env</code> v2 usage. (<a href="https://redirect.github.com/axios/axios/pull/7499">#7499</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2><a href="https://github.com/axios/axios/compare/v1.13.2...v1.13.3">1.13.3</a> (2026-01-20)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>http2:</strong> Use port 443 for HTTPS connections by default. (<a href="https://redirect.github.com/axios/axios/issues/7256">#7256</a>) (<a href="https://github.com/axios/axios/commit/d7e60653460480ffacecf85383012ca1baa6263e">d7e6065</a>)</li> <li><strong>interceptor:</strong> handle the error in the same interceptor (<a href="https://redirect.github.com/axios/axios/issues/6269">#6269</a>) (<a href="https://github.com/axios/axios/commit/5945e40bb171d4ac4fc195df276cf952244f0f89">5945e40</a>)</li> <li>main field in package.json should correspond to cjs artifacts (<a href="https://redirect.github.com/axios/axios/issues/5756">#5756</a>) (<a href="https://github.com/axios/axios/commit/7373fbff24cd92ce650d99ff6f7fe08c2e2a0a04">7373fbf</a>)</li> <li><strong>package.json:</strong> add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (<a href="https://redirect.github.com/axios/axios/issues/5754">#5754</a>) (<a href="https://github.com/axios/axios/commit/b89217e3e91de17a3d55e2b8f39ceb0e9d8aeda8">b89217e</a>)</li> <li>silentJSONParsing=false should throw on invalid JSON (<a href="https://redirect.github.com/axios/axios/issues/7253">#7253</a>) (<a href="https://redirect.github.com/axios/axios/issues/7257">#7257</a>) (<a href="https://github.com/axios/axios/commit/7d19335e43d6754a1a9a66e424f7f7da259895bf">7d19335</a>)</li> <li>turn AxiosError into a native error (<a href="https://redirect.github.com/axios/axios/issues/5394">#5394</a>) (<a href="https://redirect.github.com/axios/axios/issues/5558">#5558</a>) (<a href="https://github.com/axios/axios/commit/1c6a86dd2c0623ee1af043a8491dbc96d40e883b">1c6a86d</a>)</li> <li><strong>types:</strong> add handlers to AxiosInterceptorManager interface (<a href="https://redirect.github.com/axios/axios/issues/5551">#5551</a>) (<a href="https://github.com/axios/axios/commit/8d1271b49fc226ed7defd07cd577bd69a55bb13a">8d1271b</a>)</li> <li><strong>types:</strong> restore AxiosError.cause type from unknown to Error (<a href="https://redirect.github.com/axios/axios/issues/7327">#7327</a>) (<a href="https://github.com/axios/axios/commit/d8233d9e8e9a64bfba9bbe01d475ba417510b82b">d8233d9</a>)</li> <li>unclear error message is thrown when specifying an empty proxy authorization (<a href="https://redirect.github.com/axios/axios/issues/6314">#6314</a>) (<a href="https://github.com/axios/axios/commit/6ef867e684adf7fb2343e3b29a79078a3c76dc29">6ef867e</a>)</li> </ul> <h3>Features</h3> <ul> <li>add <code>undefined</code> as a value in AxiosRequestConfig (<a href="https://redirect.github.com/axios/axios/issues/5560">#5560</a>) (<a href="https://github.com/axios/axios/commit/095033c626895ecdcda2288050b63dcf948db3bd">095033c</a>)</li> <li>add automatic minor and patch upgrades to dependabot (<a href="https://redirect.github.com/axios/axios/issues/6053">#6053</a>) (<a href="https://github.com/axios/axios/commit/65a7584eda6164980ddb8cf5372f0afa2a04c1ed">65a7584</a>)</li> <li>add Node.js coverage script using c8 (closes <a href="https://redirect.github.com/axios/axios/issues/7289">#7289</a>) (<a href="https://redirect.github.com/axios/axios/issues/7294">#7294</a>) (<a href="https://github.com/axios/axios/commit/ec9d94e9f88da13e9219acadf65061fb38ce080a">ec9d94e</a>)</li> <li>added copilot instructions (<a href="https://github.com/axios/axios/commit/3f83143bfe617eec17f9d7dcf8bafafeeae74c26">3f83143</a>)</li> <li>compatibility with frozen prototypes (<a href="https://redirect.github.com/axios/axios/issues/6265">#6265</a>) (<a href="https://github.com/axios/axios/commit/860e03396a536e9b926dacb6570732489c9d7012">860e033</a>)</li> <li>enhance pipeFileToResponse with error handling (<a href="https://redirect.github.com/axios/axios/issues/7169">#7169</a>) (<a href="https://github.com/axios/axios/commit/88d78842541610692a04282233933d078a8a2552">88d7884</a>)</li> <li><strong>types:</strong> Intellisense for string literals in a widened union (<a href="https://redirect.github.com/axios/axios/issues/6134">#6134</a>) (<a href="https://github.com/axios/axios/commit/f73474d02c5aa957b2daeecee65508557fd3c6e5">f73474d</a>), closes <a href="https://redirect.github.com//redirect.github.com/microsoft/TypeScript/issues/33471/issues/issuecomment-1376364329">microsoft/TypeScript#33471</a></li> </ul> <h3>Reverts</h3> <ul> <li>Revert "fix: silentJSONParsing=false should throw on invalid JSON (<a href="https://redirect.github.com/axios/axios/issues/7253">#7253</a>) (<a href="https://redirect.github.com/axios/axios/issues/7">#7</a>…" (<a href="https://redirect.github.com/axios/axios/issues/7298">#7298</a>) (<a href="https://github.com/axios/axios/commit/a4230f5581b3f58b6ff531b6dbac377a4fd7942a">a4230f5</a>), closes <a href="https://redirect.github.com/axios/axios/issues/7253">#7253</a> <a href="https://redirect.github.com/axios/axios/issues/7">#7</a> <a href="https://redirect.github.com/axios/axios/issues/7298">#7298</a></li> <li><strong>deps:</strong> bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (<a href="https://redirect.github.com/axios/axios/issues/7334">#7334</a>) (<a href="https://github.com/axios/axios/commit/2d6ad5e48bd29b0b2b5e7e95fb473df98301543a">2d6ad5e</a>)</li> </ul> <h3>Contributors to this release</h3> <ul> <li><!-- raw HTML omitted --> <a href="https://github.com/ashvin2005" title="+1752/-4 ([#7218](axios/axios#7218) [#7218](axios/axios#7218) )">Ashvin Tiwari</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/mochinikunj" title="+940/-12 ([#7294](axios/axios#7294) [#7294](axios/axios#7294) )">Nikunj Mochi</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/imanchalsingh" title="+544/-102 ([#7169](axios/axios#7169) [#7185](axios/axios#7185) )">Anchal Singh</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/jasonsaayman" title="+317/-73 ([#7334](axios/axios#7334) [#7298](axios/axios#7298) )">jasonsaayman</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/brodo" title="+99/-120 ([#5558](axios/axios#5558) )">Julian Dax</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/AKASHDHARDUBEY" title="+167/-0 ([#7287](axios/axios#7287) [#7288](axios/axios#7288) )">Akash Dhar Dubey</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/madhumitaaa" title="+20/-68 ([#7198](axios/axios#7198) )">Madhumita</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/Tackoil" title="+80/-2 ([#6269](axios/axios#6269) )">Tackoil</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/justindhillon" title="+41/-41 ([#6324](axios/axios#6324) [#6315](axios/axios#6315) )">Justin Dhillon</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/Rudrxxx" title="+71/-2 ([#7257](axios/axios#7257) )">Rudransh</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/WuMingDao" title="+36/-36 ([#7215](axios/axios#7215) )">WuMingDao</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/codenomnom" title="+70/-0 ([#7201](axios/axios#7201) [#7201](axios/axios#7201) )">codenomnom</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/Nandann018-ux" title="+60/-10 ([#7272](axios/axios#7272) )">Nandan Acharya</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/KernelDeimos" title="+22/-40 ([#7042](axios/axios#7042) )">Eric Dubé</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/tiborpilz" title="+40/-4 ([#5551](axios/axios#5551) )">Tibor Pilz</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/joaoGabriel55" title="+31/-4 ([#6314](axios/axios#6314) )">Gabriel Quaresma</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/turadg" title="+23/-6 ([#6265](axios/axios#6265) )">Turadg Aleahmad</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/772a4e54ecc4cc2421e2b746daff0aca10f359d7"><code>772a4e5</code></a> chore(release): prepare release 1.15.0 (<a href="https://redirect.github.com/axios/axios/issues/10671">#10671</a>)</li> <li><a href="https://github.com/axios/axios/commit/4b071371be2f810b4bc7797a13838e0f806ebb22"><code>4b07137</code></a> chore(deps-dev): bump vite from 8.0.0 to 8.0.5 in /tests/smoke/esm (<a href="https://redirect.github.com/axios/axios/issues/10663">#10663</a>)</li> <li><a href="https://github.com/axios/axios/commit/51e57b39db251bfe3d34af5c943dfea18e06c8b6"><code>51e57b3</code></a> chore(deps-dev): bump vite from 8.0.2 to 8.0.5 (<a href="https://redirect.github.com/axios/axios/issues/10664">#10664</a>)</li> <li><a href="https://github.com/axios/axios/commit/fba1a77930f0c459677b729161627234b88c90aa"><code>fba1a77</code></a> chore(deps-dev): bump vite from 8.0.2 to 8.0.5 in /tests/module/esm (<a href="https://redirect.github.com/axios/axios/issues/10665">#10665</a>)</li> <li><a href="https://github.com/axios/axios/commit/0bf6e28eac86e87da2b60bbf5ea4237910e1a08e"><code>0bf6e28</code></a> chore(deps): bump denoland/setup-deno in the github-actions group (<a href="https://redirect.github.com/axios/axios/issues/10669">#10669</a>)</li> <li><a href="https://github.com/axios/axios/commit/8107157c572ee4a54cb28c01ab7f7f3d895ba661"><code>8107157</code></a> chore(deps-dev): bump the development_dependencies group with 4 updates (<a href="https://redirect.github.com/axios/axios/issues/10670">#10670</a>)</li> <li><a href="https://github.com/axios/axios/commit/e66530e3302d56176befd0778155dafea2487542"><code>e66530e</code></a> ci: require npm-publish environment for releases (<a href="https://redirect.github.com/axios/axios/issues/10666">#10666</a>)</li> <li><a href="https://github.com/axios/axios/commit/49f23cbfe4d308a075281c5f798d4c68f648cbe2"><code>49f23cb</code></a> chore(sponsor): update sponsor block (<a href="https://redirect.github.com/axios/axios/issues/10668">#10668</a>)</li> <li><a href="https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1"><code>3631854</code></a> fix: unrestricted cloud metadata exfiltration via header injection chain (<a href="https://redirect.github.com/axios/axios/issues/10">#10</a>...</li> <li><a href="https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"><code>fb3befb</code></a> fix: no_proxy hostname normalization bypass leads to ssrf (<a href="https://redirect.github.com/axios/axios/issues/10661">#10661</a>)</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v1.13.5...v1.15.0">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version modifies <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/teams.py/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
heyitsaamir
approved these changes
Apr 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release PR
Merges latest changes from
mainintoalpha/v2.0.0to produce a new alpha release on PyPI.Changes included