[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

Prepare the next Python release with reviewed package versions, migration guidance, compatible dependency bounds, refreshed lockfiles, and one publication batch manifest.

#10147 has merged. This branch is rebased onto main at 25ecd6768ece2ff6ef25f375eeb5621fd08e34d4, includes its implementation, and has passed the affected MCP/Foundry Toolbox regression selection and release validation. The changelog entry matches the merged concurrency and timeout behavior.

Description & Review Guide

• What are the major changes? Bump all 44 publishing workspace distributions with shipping changes since python-1.24.0. Set Core/root to 1.25.0, AG-UI to 1.8.0, Declarative to 1.5.0, Foundry to 1.16.1, OpenAI to 1.18.1, Orchestrations to 1.4.2, and GitHub Copilot to 2.1.2; use the 261106 date stamp for changed alpha/beta packages. Add the component-grouped changelog and seven source-backed breaking-change migrations. Refresh the Core standard-install dependency cohort and exact hosting adapter pins. Raise Core floors only for AG-UI, Declarative, Foundry Hosting, and OpenAI, based on their use of new Core APIs. Add python/.github/release-python-1.25.0.json with reviewed public smoke imports for the selected batch. Narrow the SQL Server cancellation-test exception-info assertion to a tuple for the upgraded Zuban checker. Restore Declarative's legacy cache_max_size keyword as a deprecated no-op, document the secure session behavior, and remove the changelog text/link for still-open Python: Make response overview examples runnable #9617. Consumer skills are unchanged.
• What is the impact of these changes? The release exposes the accumulated compatibility changes documented in the changelog, including Python 3.10 removal, MCP discovery/timeout defaults, AG-UI workflow ownership, workflow telemetry names, declarative MCP session lifetime, Foundry Local SDK requirements, and CodeAct host-error redaction. Those implementation changes are already in main; the compatibility parameter added here does not restore unsafe MCP session sharing. The maintainer explicitly approved retaining Declarative 1.5.0 for the security fix, with documented behavior and migration guidance rather than a major bump. The package/version selection and strict Core-floor policy were also approved. Incorporate pytest 9.2.0, ty 0.0.95, Zuban 0.10.2, and OAuthlib 4.0.1 from the four superseded Python Dependabot PRs; align integration pytest extras so the workspace resolves. Lab remains excluded from publication; only its standalone lockfile changes. No production tag, GitHub release, publication, or deployment is created by this PR.
• What do you want reviewers to focus on? Review the version selection, migration accuracy, strict Core floors, cohort bounds, hosting pins, release manifest, lockfile scope, SQL Server test correction, and the deprecated Declarative parameter. The parameter is accepted without validation, is ignored, and never alters per-invocation session isolation. The Python: Allow concurrent MCP calls with request-owned headers #10147 entry has been reconciled with its final merged behavior.

Declarative compatibility example:

from agent_framework.declarative import DefaultMCPToolHandler

# Existing initialization remains accepted, with DeprecationWarning.
legacy_handler = DefaultMCPToolHandler(cache_max_size=32)

# Recommended initialization avoids the deprecated, ignored parameter.
handler = DefaultMCPToolHandler()

Any non-None cache_max_size value is ignored and emits DeprecationWarning; there is no positivity check. Omission or None emits no warning. Both forms create and close a fresh MCP session for every invocation, including tools/list, with or without a client_provider. This applies to streaming and non-streaming workflows. Borrowed HTTP clients remain caller-owned and can share connection pools, but not MCP protocol state. Handler aclose() and async context-manager support remain removed; package and release documentation explains the migration and loss of implicit state across calls, approval waits, and checkpoint resumes. Protocol-session tests use ordinary initialization, not the deprecated parameter; constructor-specific tests cover its warning behavior.

Local checks on the release preparation:

• uv run --directory python --group tool-runtime poe validate-python-release --base-ref origin/main — passed after the compatibility addition; all 88 lower/upper dependency and public-import probes for 44 distributions passed.
• uv run --directory python --group tool-runtime python -m scripts.prepare_release --check --base-ref origin/main --tag python-1.25.0 — passed after the latest corrections; the manifest matches all 44 selected distributions.
• uv run --directory python --group tool-runtime python -m pytest packages/declarative/tests -m 'not integration' --import-mode=importlib -q -o addopts='' --disable-warnings — passed after the latest corrections; 1,606 passed.
• uv run --directory python --group tool-runtime poe syntax -P declarative -C — passed after the latest corrections.
• uv run --directory python --group tool-runtime poe pyright -P declarative — passed after removing cache-size validation; no errors or warnings.
• uv run --directory python --group tool-runtime poe test-typing -P declarative — passed after removing cache-size validation; all five configured checkers passed.
• uv run --directory python --group tool-runtime python -m pytest packages/core/tests/core/test_mcp.py packages/core/tests/core/test_mcp_http_auth.py packages/core/tests/core/test_mcp_observability.py packages/core/tests/core/test_mcp_skills.py packages/foundry_hosting/tests/test_toolbox.py -m 'not integration' --import-mode=importlib -q -o addopts='' — passed after rebasing; 1,526 passed, 3 skipped, 2 deselected. Existing warnings remain. An initial invocation without importlib mode failed collection; the command above uses the required collection mode.
• uv run --directory python --group tool-runtime python -m pytest scripts/tests scripts/dependencies/tests -q -o addopts='' — passed during release preparation; 194 passed, 1 skipped, 8 subtests passed.
• uv run --directory python --package agent-framework-sql-server --group tool-runtime python -m scripts.workspace_poe_tasks test-typing -P sql-server — passed for the typing fix; all five configured checkers passed.
• uv run --directory python --package agent-framework-sql-server --group tool-runtime python -m pytest packages/sql-server/tests/sql_server/test_vector_store.py -m 'not integration' -q -o addopts='' — passed for the typing fix; 43 passed with one existing experimental warning.
• git diff --check — passed for the latest corrections. Changelog coverage passed with Python: Make response overview examples runnable #9617 explicitly excluded and all remaining PR references retained exactly once. The consumer skill file matches main.

The full workspace test/type-check matrix was not rerun locally. Native Hyperlight backend verification remains required before production publication.

Related Issue

Maintainer-requested release preparation; no linked issue. This is not a trivial-change or repository-automation exception.

Includes the merged #10147 fix. Supersedes the dependency updates in #10115, #10128, #10129, and #10140; all four Dependabot PRs were closed as superseded with maintainer authorization. #9617 remains open and has been excluded from this release's changelog. No existing open python-release PR was found before creation.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: Copilot assisted with release inventory, changelog and migration drafting, package versions and dependency bounds, lockfile updates, release manifest preparation, the SQL Server test-typing correction, the Declarative compatibility parameter and tests, package/release documentation, focused validation, and this PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🔵 Needs a closer look

The release depends on unmerged #10147, reconciliation with its final behavior, and MCP/Foundry Toolbox regression, final release, and native Hyperlight checks unavailable in this metadata-only review.

No open issues 🎉

What changed in this PR

Prepares the Agent Framework Python 1.25.0 release through package metadata, dependency alignment, migration documentation, and a publication manifest. This draft depends on #10147 merging and subsequent release validation; it does not publish or deploy anything.

Changes:

• Advances 44 distributions, aligns Core dependency bounds and hosting pins, and records public smoke imports.
• Adds component-grouped release notes with seven breaking-change migrations.
• Updates pytest and type-checker pins, refreshes workspace metadata, and incorporates OAuthlib 4.0.1 in standalone lockfiles while keeping Lab excluded from publication.

File	Description
python/​uv.lock	Synchronizes workspace versions and pytest 9.2.0.
python/​tooling/​requirements-typing.txt	Updates ty and Zuban pins.
python/​samples/​04-hosting/​foundry-hosted-agents/​invocations/​telegram/​uv.lock	Updates OAuthlib to 4.0.1.
python/​pyproject.toml	Sets release 1.25.0, exact Core dependency, and pytest pin.
python/​packages/​typesafe/​pyproject.toml	Advances TypeSafe alpha version.
python/​packages/​tools/​pyproject.toml	Advances built-in tools beta version.
python/​packages/​sql-server/​pyproject.toml	Advances SQL Server alpha version.
python/​packages/​redis/​pyproject.toml	Advances Redis beta version.
python/​packages/​qdrant/​pyproject.toml	Advances Qdrant alpha version.
python/​packages/​purview/​pyproject.toml	Advances Purview beta version.
python/​packages/​postgres/​pyproject.toml	Advances PostgreSQL alpha version.
python/​packages/​orchestrations/​pyproject.toml	Sets Orchestrations version 1.4.2.
python/​packages/​oracle/​pyproject.toml	Advances Oracle alpha version.
python/​packages/​openai/​pyproject.toml	Sets version 1.18.1 and Core 1.25 minimum.
python/​packages/​ollama/​pyproject.toml	Advances Ollama beta version.
python/​packages/​nvidia/​pyproject.toml	Advances NVIDIA alpha version.
python/​packages/​monty/​pyproject.toml	Advances Monty beta version.
python/​packages/​mongodb/​pyproject.toml	Advances MongoDB alpha version.
python/​packages/​mistral/​pyproject.toml	Advances Mistral beta version.
python/​packages/​mem0/​pyproject.toml	Advances Mem0 beta version.
python/​packages/​lab/​uv.lock	Updates OAuthlib without releasing Lab.
python/​packages/​hyperlight/​pyproject.toml	Advances Hyperlight beta version.
python/​packages/​hosting/​pyproject.toml	Advances shared hosting alpha version.
python/​packages/​hosting-telegram/​pyproject.toml	Advances adapter version and aligns hosting pin.
python/​packages/​hosting-responses/​pyproject.toml	Advances adapter version and aligns hosting pin.
python/​packages/​hosting-mcp/​pyproject.toml	Advances adapter version and aligns hosting pin.
python/​packages/​hosting-a2a/​pyproject.toml	Advances adapter version and aligns hosting pin.
python/​packages/​github_copilot/​pyproject.toml	Sets GitHub Copilot version 2.1.2.
python/​packages/​gemini/​pyproject.toml	Advances Gemini beta version.
python/​packages/​foundry/​pyproject.toml	Sets Foundry version 1.16.1.
python/​packages/​foundry_local/​pyproject.toml	Advances Foundry Local beta version.
python/​packages/​foundry_hosting/​pyproject.toml	Advances beta version and requires Core 1.25.
python/​packages/​duckdb/​pyproject.toml	Advances DuckDB alpha version.
python/​packages/​devui/​pyproject.toml	Advances beta version and aligns pytest extras.
python/​packages/​declarative/​pyproject.toml	Sets version 1.5.0 and Core 1.25 minimum.
python/​packages/​core/​pyproject.toml	Sets Core 1.25.0 and refreshes standard-install dependencies.
python/​packages/​copilotstudio/​pyproject.toml	Advances Copilot Studio beta version.
python/​packages/​claude/​pyproject.toml	Advances Claude beta version.
python/​packages/​chatkit/​pyproject.toml	Advances ChatKit beta version.
python/​packages/​bedrock/​pyproject.toml	Advances Bedrock beta version.
python/​packages/​azure-documentdb/​pyproject.toml	Advances Azure DocumentDB alpha version.
python/​packages/​azure-cosmos/​pyproject.toml	Advances Azure Cosmos DB beta version.
python/​packages/​azure-cosmos-memory/​pyproject.toml	Advances Cosmos Memory alpha version.
python/​packages/​azure-contentunderstanding/​pyproject.toml	Advances Content Understanding beta version.
python/​packages/​azure-ai-search/​pyproject.toml	Advances Azure AI Search beta version.
python/​packages/​anthropic/​pyproject.toml	Advances Anthropic beta version.
python/​packages/​ag-ui/​pyproject.toml	Sets version 1.8.0, Core minimum, and pytest pin.
python/​packages/​a2a/​pyproject.toml	Advances A2A beta version.
python/​CHANGELOG.md	Adds release notes, migrations, and comparison links.
python/​.github/​release-python-1.25.0.json	Defines the 44-package publication batch and smoke imports.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 91f4417a5b0c
Model: gpt-5.6-sol

Overview

The release tooling tightly validates manifest completeness, exact package versions, reviewed smoke imports, dependency bounds, and immutable tag inputs, while the publication path remains outside this PR workflow. The batch also provides explicit migration guidance for its compatibility changes. However, Core is being cut as a minor release while documenting backwards-incompatible behavior, so consumers using the repository's stated SemVer contract can receive breaking changes through otherwise compatible version ranges.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 high) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/core/pyproject.toml

[github-actions]

MAF Automated Review — Iteration 2

Result: Findings reported
Scope: full PR (2 commit(s)): d5487e616f93, 0d6af3f9bb2a
Model: gpt-5.6-sol

Overview

The release manifest, exact root/Core coupling, dependency probes, and CI validation provide strong guardrails around the 44-package publication batch. However, the AG-UI and Declarative packages are both marked stable and are being released under minor versions despite documented contract-breaking behavior, so ordinary <2 consumers can upgrade into hard runtime failures without opting into a major version.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (2 high) across 2 files. Details are attached to the affected lines below.

Affected areas: python/packages/ag-ui/pyproject.toml, python/packages/declarative/pyproject.toml

[Jose Alvarez (jpalvarezl)]

The changelog issue is resolved. The added cache_max_size compatibility shim preserves the legacy keyword without restoring shared MCP sessions, and the implementation, ADR, documentation, and tests are consistent.