Skip to content

.Net: Address vulnerable packages (+Update MsGraph for latest Major V5) - #12962

Merged
Roger Barreto (rogerbarreto) merged 3 commits into
microsoft:mainfrom
rogerbarreto:fix-vulnerable-packages
Aug 19, 2025
Merged

Roger Barreto (rogerbarreto) merged 3 commits into
microsoft:mainfrom
rogerbarreto:fix-vulnerable-packages

Conversation

@rogerbarreto

Copy link
Copy Markdown
Member

Motivation and Context

This PR addresses a recent vulnerability warning received while working in the Semantic Kernel solution, limited to specific packages for Prompty, Milvus and Microsoft Graph Plugin.

As part of addressing the vulnerabilities was also necessary to upgrade the logic to use the newest packages from Microsoft.Graph library.

@rogerbarreto
Roger Barreto (rogerbarreto) requested a review from a team as a code owner August 18, 2025 13:23
@moonbox3 Evan Mattson (moonbox3) added the .NET Issue or Pull requests regarding .NET code label Aug 18, 2025
@rogerbarreto
Roger Barreto (rogerbarreto) marked this pull request as draft August 18, 2025 13:25
@rogerbarreto Roger Barreto (rogerbarreto) changed the title .Net: Address vulnerable packages (+Update MsGraph for latest Major V5) .Net: [WIP] Address vulnerable packages (+Update MsGraph for latest Major V5) Aug 18, 2025
@rogerbarreto
Roger Barreto (rogerbarreto) marked this pull request as ready for review August 19, 2025 16:02
@rogerbarreto Roger Barreto (rogerbarreto) changed the title .Net: [WIP] Address vulnerable packages (+Update MsGraph for latest Major V5) .Net: Address vulnerable packages (+Update MsGraph for latest Major V5) Aug 19, 2025
@rogerbarreto
Roger Barreto (rogerbarreto) added this pull request to the merge queue Aug 19, 2025
Merged via the queue into microsoft:main with commit ca3c7d9 Aug 19, 2025
@rogerbarreto
Roger Barreto (rogerbarreto) deleted the fix-vulnerable-packages branch August 19, 2025 19:29
jcruzmot-te pushed a commit to thousandeyes/aia-semantic-kernel that referenced this pull request Sep 15, 2025
…5) (microsoft#12962)

### Motivation and Context

This PR addresses a recent vulnerability warning received while working
in the Semantic Kernel solution, limited to specific packages for
Prompty, Milvus and Microsoft Graph Plugin.

As part of addressing the vulnerabilities was also necessary to upgrade
the logic to use the newest packages from Microsoft.Graph library.
S.J. (cstolting-collab) pushed a commit to cstolting-collab/semantic-kernel that referenced this pull request Nov 3, 2026
…ion (microsoft#14715)

### Motivation and Context

A full link-integrity scan of the repository's README files found 13
dead internal links in 4 files. The underlying sample files were deleted
or moved by recent refactors (planner removal microsoft#12399, MEVD Preview 2
microsoft#11028, MsGraph V5 update microsoft#12962, and the Gemini thinking-budget sample
rename in microsoft#13396), but the README entries still point at the old paths.

### Description

- **dotnet/samples/Concepts/README.md**
- `Google_GeminiChatCompletionWithThinkingBudget` -> renamed sample
`Google_GeminiChatCompletionWithThinking` (renamed in microsoft#13396)
- Removed the `VectorStore_DataIngestion_CustomMapper` entry (sample
deleted in microsoft#11028, no replacement)
- Removed the entire `Planners` section (all three samples deleted in
microsoft#12399)
- Removed `MsGraph_ContactsPlugin` / `MsGraph_DrivePlugin` /
`MsGraph_TasksPlugin` entries (no longer present after the MsGraph V5
update in microsoft#12962)
- Removed `WithFunctionCallingStepwisePlanner` entry (deleted together
with the planners in microsoft#12399)
- **dotnet/samples/Demos/OnnxSimpleRAG/README.md**
- Vector Store abstractions link ->
[Microsoft.Extensions.VectorData.Abstractions in
dotnet/extensions](https://github.com/dotnet/extensions/tree/main/src/Libraries/Microsoft.Extensions.VectorData.Abstractions)
(the `dotnet/src/VectorData/VectorData.Abstractions` README itself
points there)
- `InMemoryVectorStore` -> [CommunityToolkit/AI
MEVD/src/InMemory/InMemoryVectorStore.cs](https://github.com/CommunityToolkit/AI/blob/main/MEVD/src/InMemory/InMemoryVectorStore.cs)
(same pointer as `dotnet/src/VectorData/InMemory/README.md`)
- **python/semantic_kernel/connectors/memory_stores/redis/README.md**
- .NET README link -> `dotnet/src/VectorData/Redis/README.md` (current
in-repo location, which forwards to the CommunityToolkit repository)
- **python/samples/concepts/README.md**
- Search section link -> `python/semantic_kernel/connectors/search.py`
(the `connectors/search` directory no longer exists; search now lives in
`search.py`)

### Verification

All 5 new URLs were checked and return HTTP 200. All 13 removed/updated
links were verified to return HTTP 404 against `main` before this
change.

Docs-only change: no code is touched, so builds and unit tests are
unaffected.

This branch was previously deployed

1 inactive deployment
integration — 2636a8a0 Deployed Aug 19, 2025 by rogerbarreto
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation .NET Issue or Pull requests regarding .NET code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants