Release 2.0.12: merge main into release by corinagum · Pull Request #442 · microsoft/teams.py

corinagum · 2026-05-27T22:16:18Z

Summary

Brings origin/main into release for the 2.0.12 release. No carve-outs this time — Quoted Replies (PR #321) is included.

version.json: 2.0.11 → 2.0.12.

Aligns with teams.ts/teams.net cadence.

What's in this release (delta from 2.0.11)

Features

Quoted Replies & new quotes features (Updated quoted replies & new quotes features #321) — previously held back
SuggestedActionSubmitActivity for suggestedAction/submit invoke (SuggestedActionSubmitActivity for suggestedAction/submit invoke #434)
Default targeted replies for targeted inbound messages (Default targeted replies for targeted inbound messages #439)
Reactions API marked GA (Mark reactions API as GA and fix sample remove flow #427) — already shipped in 2.0.11 actually, ignore if duplicate
Prompt Preview support (Prompt Preview Support #397)
Sample: opt targeted-messages into slash commands (Sample: opt targeted-messages example into slash commands #430)
Sample: a2a-in-teams (Sample : a2a-in-teams #401)
Sample: proactive message update (Add proactive message update example #405)
Allow custom HTTP client via AppOptions (Allow passing a custom HTTP client via AppOptions #416)

Security & fixes

Lock JsonWebToken trust-boundary contract (Security: lock JsonWebToken trust-boundary contract #432)
Bump starlette 1.0.0 -> 1.1.0 for PYSEC-2026-161 / BadHost (fix(deps): bump starlette 1.0.0 -> 1.1.0 for PYSEC-2026-161 (BadHost) #441)
warn when bot starts without credentials (feat: warn when bot starts without credentials #435)
fix(apps): support AAD v1 issuers in Entra token validation (fix(apps): support AAD v1 issuers in Entra token validation #422)
fix(apps): log inbound activities at info, warn on missing Authorization (fix(apps): log inbound activities at info, warn on missing Authorization #425)
fix(http-stream): wait for in-flight flush before sending final close (fix(http-stream): wait for in-flight flush before sending final close message #419)
Mark reactions API as GA and fix sample remove flow (Mark reactions API as GA and fix sample remove flow #427)
Revert serviceUrl allowlist (ADO 5310460) (Revert serviceUrl allowlist (ADO 5310460) #415)
Route app.get_app_graph + ctx.*_graph to sovereign endpoints via cloud.graph_scope (fix: route app.get_app_graph + ctx.*_graph to sovereign endpoints via cloud.graph_scope #402)

Deprecations / package changes

Remove ai, openai, mcpplugin, a2a, and devtools packages (remove ai, openai, mcpplugin, a2a, and devtools packages #413)
Restore and deprecate devtools package (Restore and deprecate devtools package #410)
Deprecate ai, openai, mcpplugin, a2a packages (Deprecate ai, openai, mcpplugin, and a2a packages #406)
Add agent framework example, remove chatprompt/mcp client samples (Add agent framework example (and remove sample for chatprompt and mcp client) #386)

Dependency bumps

urllib3 2.6.3 → 2.7.0 (build(deps): bump urllib3 from 2.6.3 to 2.7.0 #426)
python-multipart 0.0.26 → 0.0.27 (build(deps): bump python-multipart from 0.0.26 to 0.0.27 #424)
microsoft-kiota-http 1.9.7 → 1.9.9 (build(deps): bump microsoft-kiota-http from 1.9.7 to 1.9.9 #423)
idna 3.11 → 3.15 (build(deps): bump idna from 3.11 to 3.15 #431)
starlette 1.0.0 → 1.1.0 (fix(deps): bump starlette 1.0.0 -> 1.1.0 for PYSEC-2026-161 (BadHost) #441, security)
/examples/tab/Web: qs, postcss, uuid, follow-redirects bumps

Quoted Replies inclusion notes

Teams client rendering is in-sync with the wire format as of 2026-05-06.
APX QR rollout completed: Public 2026-04-10, GCCH/DoD/Gallatin 2026-04-14.
Builder methods (prepend_quote(), add_quote()), ctx.quote(), and the quote-aware ctx.reply() behavior are all present in this release.
examples/quoting is included.

Conflict resolution

The 2.0.11 release branch had the QR-removed shape for four files; took main's (QR-included) version for all of them:

examples/targeted-messages/src/main.py
packages/api/src/microsoft_teams/api/activities/message/message.py
packages/apps/src/microsoft_teams/apps/routing/activity_context.py
packages/apps/tests/test_activity_context.py

version.json conflict resolved to 2.0.12.

Test plan

uv sync clean
poe check (ruff format + lint) — clean
poe test — 609 passed
pyright — 0 errors, 0 warnings
Pipeline build + test stages green on release after merge
Publish pipeline run with Public → ESRP approval → PyPI
pip install microsoft-teams-apps==2.0.12 smoke install

… message (#419) Fixes #418 ## Summary `HttpStream.close()` could send the final stream message while `_flush()` was still mid-await, causing the final message to arrive before in-flight chunks finished sending. This is the Python parity of [microsoft/teams.ts#553](microsoft/teams.ts#553) (Bug 2 only — Bug 1 from the TS PR does not affect Python; `close()` already calls `with_channel_data()` before `add_stream_final()`). ## Root cause `_wait_for_id_and_queue()` polled: ```python while (self._queue or not self._id) and not self._canceled: ``` This checks the queue and `_id` but not whether `_flush()` is currently holding `self._lock`. After the inner `while self._queue` loop drains the queue, `_flush()` awaits `_send_activity(...)` calls under the lock. During those awaits: - `self._queue` is empty (drained) - `self._id` is set (after the first chunk) - `self._lock` is still held The predicate becomes false, the wait exits, and `close()` proceeds to send the final activity — racing the in-flight chunk. ## Fix Add `self._lock.locked()` to the wait predicate. The lock primitive is already used in `close()`'s early-return guard at line 157, so this is consistent with existing patterns. ## Test plan - [x] Added `test_close_waits_for_flush_to_complete` — holds `stream._lock` manually, asserts `close()` does not send the final message until the lock is released. - [x] All existing http-stream tests still pass (14/14). - [x] Full apps test suite passes (271 passed). - [x] `poe check` passes (ruff format + lint).

## Summary Mirrors [microsoft/teams.ts#556](microsoft/teams.ts#556) in this codebase. Some valid Microsoft Entra access tokens are issued with the Azure AD v1 issuer format (`https://sts.windows.net/{tenantId}/`) instead of the v2 issuer (`https://login.microsoftonline.com/{tenantId}/v2.0`). Today `TokenValidator.for_entra` only accepts the v2 form, causing valid v1 tokens to be rejected. ## Changes - `packages/apps/src/microsoft_teams/apps/auth/token_validator.py`: when a `tenant_id` is provided, `TokenValidator.for_entra` now adds both the v2 (`{login_endpoint}/{tenant_id}/v2.0`) and v1 (`https://sts.windows.net/{tenant_id}/`) issuers to `valid_issuers`. - `packages/apps/tests/test_token_validator.py`: - Updated `test_for_entra_initialization` to assert both issuers are present. - Added `test_validate_entra_token_v1_sts_issuer` covering acceptance of a v1 `sts.windows.net` issuer through the full validation pipeline. Note: Unlike the TS PR, this change does not introduce multi-tenant `allowedTenantIds` semantics, since the Python `TokenValidator` doesn't currently expose multi-tenant configuration. The fix is kept narrowly scoped to issuer format acceptance. Reference: https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens ## Test plan - `uv run pytest packages/apps/tests/test_token_validator.py -q` — all 27 tests pass, including the new v1 issuer test.

<img width="800" height="234" alt="image" src="https://github.com/user-attachments/assets/3b28b69a-346d-4610-8c24-a313fd26f488" /> - Add `QuotedReplyEntity` Pydantic model with nested `QuotedReplyData` (`message_id` required, `sender_id`/`sender_name`/`preview`/`time`/`is_reply_deleted`/`validated_message_reference` optional); register in Entity union - Add `get_quoted_messages()` on `MessageActivity` to read inbound quoted reply entities - Add `add_quoted_reply(message_id, response?)` builder on `MessageActivityInput` - Update `reply()` to stamp` QuotedReplyEntity + <quoted messageId="..."/>` placeholder instead of blockquote HTML; remove `reply_to_id` assignment - Add `quote_reply()` on `ActivityContext` - Mark all quoted reply types and methods as `@experimental` - Add quoted-replies example exercising all APIs --------- Co-authored-by: Corina Gum <> Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

Prompt preview allows a bot to reference the original targeted message in its reply, so Teams can render a collapsible preview of the user's prompt. When a bot replies to a targeted message (reactive scenarios), the SDK now passes the original message's messageId via a targetedMessageInfo entity in the activity's entities array. For proactive replies, developers can attach the entity themselves with the messageId of the targeted message.

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.6.3 to 2.7.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.7.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.</p> <ul> <li> <p>Decompression-bomb safeguards of the streaming API were bypassed:</p> <ol> <li>When <code>HTTPResponse.drain_conn()</code> was called after the response had been read and decompressed partially. (Reported by <a href="https://github.com/Cycloctane"><code>@Cycloctane</code></a>)</li> <li>During the second <code>HTTPResponse.read(amt=N)</code> or <code>HTTPResponse.stream(amt=N)</code> call when the response was decompressed using the official <a href="https://pypi.org/project/brotli/">Brotli</a> library. (Reported by <a href="https://github.com/kimkou2024"><code>@kimkou2024</code></a>)</li> </ol> <p>See GHSA-mf9v-mfxr-j63j for details.</p> </li> <li> <p>HTTP pools created using <code>ProxyManager.connection_from_url</code> did not strip sensitive headers specified in <code>Retry.remove_headers_on_redirect</code> when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by <a href="https://github.com/christos-spearbit"><code>@christos-spearbit</code></a>)</p> </li> </ul> <h2>Deprecations and Removals</h2> <ul> <li>Used <code>FutureWarning</code> instead of <code>DeprecationWarning</code> for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3763">urllib3/urllib3#3763</a>)</li> <li>Removed support for end-of-life Python 3.9. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3720">urllib3/urllib3#3720</a>)</li> <li>Removed support for end-of-life PyPy3.10. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4979">urllib3/urllib3#4979</a>)</li> <li>Bumped the minimum supported pyOpenSSL version to 19.0.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3777">urllib3/urllib3#3777</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was ignoring decompressed data buffered from previous partial reads. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3636">urllib3/urllib3#3636</a>)</li> <li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only part of the response after a partial read when <code>cache_content=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4967">urllib3/urllib3#4967</a>)</li> <li>Fixed <code>HTTPResponse.stream()</code> and <code>HTTPResponse.read_chunked()</code> to handle <code>amt=0</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3793">urllib3/urllib3#3793</a>)</li> <li>Updated <code>_TYPE_BODY</code> type alias to include missing <code>Iterable[str]</code>, matching the documented and runtime behavior of chunked request bodies. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3798">urllib3/urllib3#3798</a>)</li> <li>Fixed <code>LocationParseError</code> when paths resembling schemeless URIs were passed to <code>HTTPConnectionPool.urlopen()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3352">urllib3/urllib3#3352</a>)</li> <li>Fixed <code>BaseHTTPResponse.readinto()</code> type annotation to accept <code>memoryview</code> in addition to <code>bytearray</code>, matching the <code>io.RawIOBase.readinto</code> contract and enabling use with <code>io.BufferedReader</code> without type errors. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3764">urllib3/urllib3#3764</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.7.0 (2026-05-07)</h1> <h2>Security</h2> <p>Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.</p> <ul> <li> <p>Decompression-bomb safeguards of the streaming API were bypassed:</p> <ol> <li>When <code>HTTPResponse.drain_conn()</code> was called after the response had been read and decompressed partially.</li> <li>During the second <code>HTTPResponse.read(amt=N)</code> or <code>HTTPResponse.stream(amt=N)</code> call when the response was decompressed using the official <code>Brotli <https://pypi.org/project/brotli/></code>__ library.</li> </ol> <p>See <code>GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j></code>__ for details.</p> </li> <li> <p>HTTP pools created using <code>ProxyManager.connection_from_url</code> did not strip sensitive headers specified in <code>Retry.remove_headers_on_redirect</code> when redirecting to a different host. (<code>GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc></code>__)</p> </li> </ul> <h2>Deprecations and Removals</h2> <ul> <li>Used <code>FutureWarning</code> instead of <code>DeprecationWarning</code> for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (<code>[#3763](urllib3/urllib3#3763) <https://github.com/urllib3/urllib3/issues/3763></code>__)</li> <li>Removed support for end-of-life Python 3.9. (<code>[#3720](urllib3/urllib3#3720) <https://github.com/urllib3/urllib3/issues/3720></code>__)</li> <li>Removed support for end-of-life PyPy3.10. (<code>[#4979](urllib3/urllib3#4979) <https://github.com/urllib3/urllib3/issues/4979></code>__)</li> <li>Bumped the minimum supported pyOpenSSL version to 19.0.0. (<code>[#3777](urllib3/urllib3#3777) <https://github.com/urllib3/urllib3/issues/3777></code>__)</li> </ul> <h2>Bugfixes</h2> <ul> <li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was ignoring decompressed data buffered from previous partial reads. (<code>[#3636](urllib3/urllib3#3636) <https://github.com/urllib3/urllib3/issues/3636></code>__)</li> <li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only part of the response after a partial read when <code>cache_content=True</code>.</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2"><code>9a950b9</code></a> Release 2.7.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc"><code>5ec0de4</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a"><code>2bdcc44</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c"><code>f45b0df</code></a> Fix a misleading example for <code>ProxyManager</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/4970">#4970</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b"><code>577193c</code></a> Switch to nightly PyPy3.11 in CI for now (<a href="https://redirect.github.com/urllib3/urllib3/issues/4984">#4984</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc"><code>e90af45</code></a> Avoid infinite loop in <code>HTTPResponse.read_chunked</code> when <code>amt=0</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/4974">#4974</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210"><code>67ed74f</code></a> Bump dev dependencies (<a href="https://redirect.github.com/urllib3/urllib3/issues/4972">#4972</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d"><code>3abd481</code></a> Upgrade mypy to version 1.20.2 (<a href="https://redirect.github.com/urllib3/urllib3/issues/4978">#4978</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890"><code>2b8725d</code></a> Drop support for EOL PyPy3.10 (<a href="https://redirect.github.com/urllib3/urllib3/issues/4979">#4979</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33"><code>2944b2a</code></a> Upgrade <code>setup-chrome</code> and <code>setup-firefox</code> to fix warnings (<a href="https://redirect.github.com/urllib3/urllib3/issues/4973">#4973</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.6.3...2.7.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=urllib3&package-manager=uv&previous-version=2.6.3&new-version=2.7.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/teams.py/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

## Summary Removes the `@experimental("ExperimentalTeamsReactions")` decorator and the `.. warning:: Preview` docstring from `ReactionClient`. The reactions feature is in sync across all three SDKs and the Teams service — no longer preview. Also fixes the sample's `unreact` command, which previously called `ctx.api.reactions.delete()` on an incoming message that had no reaction. It now adds the reaction first, waits 2 seconds, then deletes — so the demo visibly shows the full add/delete cycle. ## Cross-SDK coordination Part of the cross-SDK Reactions-GA pass. Sibling PRs: - microsoft/teams.ts — Mark reactions API as GA - microsoft/teams.net — Mark reactions API as GA (Libraries + core) - microsoft/teams-sdk — drop .NET opt-in tip from the reactions guide ## Test plan - [x] `uv run ruff check` — all checks passed - [x] `uv run ruff format --check` — 403 files already formatted - [x] `uv run pyright` — 0 errors, 0 warnings - [x] `uv run pytest` — 596 passed - [ ] Smoke run of `examples/reactions` showing the cycle in Teams ## Versioning No `version.json` change in this PR. Bump happens as part of the release flow per RELEASE.md. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Updates the `targeted-messages` example to demonstrate the slash-commands opt-in per the docs spec (microsoft/teams-sdk#2843, MicrosoftDocs/msteams-docs#14182). ## Changes - **`examples/targeted-messages/appPackage/manifest.json` (new)** — shipped at `manifestVersion: "devPreview"` because the slash-commands opt-in fields are only defined in the devPreview schema today: - `bots[].supportsTargetedMessages: true` opts the bot into receiving slash-command-style targeted messages. - `bots[].commandLists[].triggers: ["slash"]` declares `test send` / `test update` / `test delete` / `test public` / `test inbound` as slash commands surfaced in the Teams `/` picker (scoped to `team` and `groupChat`). - **`.gitignore`** — narrowly-scoped exception so this one example's manifest can be tracked. The general `examples/**/appPackage/` exclusion remains in place for other examples. - **`examples/targeted-messages/src/main.py`** — new `test inbound` handler that reads `activity.recipient.is_targeted` and reports whether the inbound message was delivered as a targeted message (the signal slash commands arrive with). - **`examples/targeted-messages/README.md`** — refreshed commands table, new "Manifest configuration" section documenting the new fields. ## Test plan - [x] `python3 -m py_compile examples/targeted-messages/src/main.py` clean - [x] `pyright examples/targeted-messages/src/main.py` clean - [x] `examples/targeted-messages/appPackage/manifest.json` validates against the Teams devPreview schema (placeholder `${{...}}` tokens excepted) - [x] Sample bot's `test inbound` handler verified live in Teams: broadcast branch fires when the inbound is not targeted (the targeted branch will fire once slash commands start delivering with `recipient.is_targeted = True`) 🤖 Generated with [Claude Code](https://claude.com/claude-code)

…ion (#425) ## Summary - Add a warn-level log on the missing-or-malformed Bearer token branch, replacing a previously silent 401. - Cross-SDK consistency fix: same diagnostic gap exists in teams.ts (companion PR: microsoft/teams.ts#568). ## Test plan - [x] `uv run poe check` (ruff format + ruff check, all pass) - [x] `uv run pyright src/microsoft_teams/apps/http/http_server.py` (0 errors) - [x] `uv run poe test` (580/580 pass) - [ ] Reviewer eyeball: confirm log message wording --------- Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>

Bumps [idna](https://github.com/kjd/idna) from 3.11 to 3.15. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/kjd/idna/blob/master/HISTORY.md">idna's changelog</a>.</em></p> <blockquote> <h2>3.15 (2026-05-12)</h2> <ul> <li>Enforce DNS-length cap on individual labels early in <code>check_label</code>, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.</li> <li>Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared <code>_unicode_dots_re</code> from <code>idna.core</code> in the codec module.</li> <li>Use <code>raise ... from err</code> for proper exception chaining and switch internal string formatting to f-strings.</li> <li>Allow <code>flit_core</code> 4.x in the build backend.</li> <li>Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.</li> <li>Add Dependabot configuration for GitHub Actions.</li> <li>Convert README and HISTORY from reStructuredText to Markdown.</li> <li>Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.</li> </ul> <p>Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.</p> <h2>3.14 (2026-05-10)</h2> <ul> <li>Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]</li> </ul> <p>Thanks to Stan Ulbrych for reporting the issue.</p> <h2>3.13 (2026-04-22)</h2> <ul> <li>Correct classification error for codepoint U+A7F1</li> </ul> <h2>3.12 (2026-04-21)</h2> <ul> <li>Update to Unicode 17.0.0.</li> <li>Issue a deprecation warning for the transitional argument.</li> <li>Added lazy-loading to provide some performance improvements.</li> <li>Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.</li> </ul> <p>Thanks to Rodrigo Nogueira for contributions to this release.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8"><code>af30a09</code></a> Release 3.15</li> <li><a href="https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2"><code>30314d4</code></a> Pre-release 3.15rc0</li> <li><a href="https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9"><code>05d4b21</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/237">#237</a> from kjd/convert-docs-to-markdown</li> <li><a href="https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee"><code>2987fdb</code></a> Convert README and HISTORY from reStructuredText to Markdown</li> <li><a href="https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c"><code>59fa800</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/236">#236</a> from kjd/dependabot/github_actions/actions-f3e34333ea</li> <li><a href="https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2"><code>def6983</code></a> Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea</li> <li><a href="https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631"><code>bbd8004</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/234">#234</a> from StanFromIreland/patch-1</li> <li><a href="https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc"><code>edd07c0</code></a> Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group</li> <li><a href="https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123"><code>5557db0</code></a> Merge branch 'master' into patch-1</li> <li><a href="https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d"><code>f11746c</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/235">#235</a> from StanFromIreland/patch-2</li> <li>Additional commits viewable in <a href="https://github.com/kjd/idna/compare/v3.11...v3.15">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=idna&package-manager=uv&previous-version=3.11&new-version=3.15)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/teams.py/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

## Summary Documents the layered authentication model the SDK uses for inbound JSON Web Tokens. Python half of a 3-SDK PR set. ## Why Security scan finding "JsonWebToken No Signature Verification" flagged the `JsonWebToken` accessor class for decoding tokens without verifying signatures (uses `verify_signature=False`). A cross-SDK audit confirmed this is intentional architecture: signature verification runs at the HTTP boundary in `TokenValidator.validate_token` (`packages/apps/src/microsoft_teams/apps/auth/token_validator.py`), and the accessor exists as a typed view over already-validated payloads. Every consumer of decoded claims is downstream of a validator pass. This PR makes the architectural invariant explicit at the constructor site so future readers (and the scanner on its next pass) see the design intent locally. ## What Contract docstring at `JsonWebToken.__init__` explaining that it performs no signature verification, where verification actually happens, and the rule that callers must not construct from raw network input. ## What this does not change - No runtime behavior change. No signature verification added or removed. - No API surface change. `JsonWebToken` keeps its current name (verified public on `microsoft_teams.api`, so a rename would have been breaking). - No effect on the activity pipeline. JWT validation continues to happen via `TokenValidator.validate_token` exactly as before. ## Related PRs - TypeScript: microsoft/teams.ts#586 - .NET: microsoft/teams.net#517 - Documentation: microsoft/teams-sdk#2850

Bumps [qs](https://github.com/ljharb/qs) from 6.15.0 to 6.15.2. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md">qs's changelog</a>.</em></p> <blockquote> <h2><strong>6.15.2</strong></h2> <ul> <li>[Fix] <code>stringify</code>: skip null/undefined entries in <code>arrayFormat: 'comma'</code> + <code>encodeValuesOnly</code> instead of crashing in <code>encoder</code></li> <li>[Fix] <code>stringify</code>: use configured <code>delimiter</code> after <code>charsetSentinel</code> (<a href="https://redirect.github.com/ljharb/qs/issues/555">#555</a>)</li> <li>[Fix] <code>stringify</code>: apply <code>formatter</code> to encoded key under <code>strictNullHandling</code> (<a href="https://redirect.github.com/ljharb/qs/issues/554">#554</a>)</li> <li>[Fix] <code>stringify</code>: skip null/undefined filter-array entries instead of crashing in <code>encoder</code> (<a href="https://redirect.github.com/ljharb/qs/issues/551">#551</a>)</li> <li>[Fix] <code>parse</code>: handle nested bracket groups and add regression tests (<a href="https://redirect.github.com/ljharb/qs/issues/530">#530</a>)</li> <li>[readme] fix grammar (<a href="https://redirect.github.com/ljharb/qs/issues/550">#550</a>)</li> <li>[Dev Deps] update <code>@ljharb/eslint-config</code></li> <li>[Tests] add regression tests for keys containing percent-encoded bracket text</li> </ul> <h2><strong>6.15.1</strong></h2> <ul> <li>[Fix] <code>parse</code>: <code>parameterLimit: Infinity</code> with <code>throwOnLimitExceeded: true</code> silently drops all parameters</li> <li>[Deps] update <code>@ljharb/eslint-config</code></li> <li>[Dev Deps] update <code>@ljharb/eslint-config</code>, <code>iconv-lite</code></li> <li>[Tests] increase coverage</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ljharb/qs/commit/9aca4076fe788338c67cf7e115f0be6bc58d85a8"><code>9aca407</code></a> v6.15.2</li> <li><a href="https://github.com/ljharb/qs/commit/5e33d33447ed0bf1ddab9abc41d27dea4687d992"><code>5e33d33</code></a> [Dev Deps] update <code>@ljharb/eslint-config</code></li> <li><a href="https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41"><code>21f80b3</code></a> [Fix] <code>stringify</code>: skip null/undefined entries in <code>arrayFormat: 'comma'</code> + `e...</li> <li><a href="https://github.com/ljharb/qs/commit/a0a81ea2071acce3eff41a040f719ac8f5c4f64c"><code>a0a81ea</code></a> [Fix] <code>stringify</code>: use configured <code>delimiter</code> after <code>charsetSentinel</code></li> <li><a href="https://github.com/ljharb/qs/commit/e3062f78f5233b338ceeb8e8dfa5a07dea4b32a8"><code>e3062f7</code></a> [Fix] <code>stringify</code>: apply <code>formatter</code> to encoded key under <code>strictNullHandling</code></li> <li><a href="https://github.com/ljharb/qs/commit/0c180a40adb8c6703fffc85b2ff06ca209f5c1e0"><code>0c180a4</code></a> [Fix] <code>stringify</code>: skip null/undefined filter-array entries instead of crashi...</li> <li><a href="https://github.com/ljharb/qs/commit/3a8b94aec19bd664720f6f6b1e66c4a0dfe4b656"><code>3a8b94a</code></a> [Tests] add regression tests for keys containing percent-encoded bracket text</li> <li><a href="https://github.com/ljharb/qs/commit/96755abd357c0e534dd3442a84a04d08864bfe0d"><code>96755ab</code></a> [readme] fix grammar</li> <li><a href="https://github.com/ljharb/qs/commit/a419ce5bbfcdb98a299f1a0bb47ea055baef20e6"><code>a419ce5</code></a> [Fix] <code>parse</code>: handle nested bracket groups and add regression tests</li> <li><a href="https://github.com/ljharb/qs/commit/3f5e1c528c967d915096787efbffa73cf6044170"><code>3f5e1c5</code></a> v6.15.1</li> <li>Additional commits viewable in <a href="https://github.com/ljharb/qs/compare/v6.15.0...v6.15.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=qs&package-manager=npm_and_yarn&previous-version=6.15.0&new-version=6.15.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/teams.py/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

## Summary - Add a startup warning in `HttpServer.initialize()` when no `CLIENT_ID` / `CLIENT_SECRET` / `TENANT_ID` is configured, so customers running anonymously know their bot accepts unauthenticated requests on `/api/messages`. - 2 new unit tests in `test_http_server.py` covering: warning fires when no creds, warning does not fire when creds present. ## Why Part of the DevTools deprecation rollout. The recommended local-testing path with Microsoft 365 Agents Playground is anonymous mode (no creds configured). The new warning makes that mode explicit at startup, so customers don't ship anonymous-mode bots to production by accident, and so the migration from DevTools to Playground produces a clear signal. Behavior is unchanged. This is pure observability. ## Test plan - [x] `pytest tests/test_http_server.py` (22/22 passing) - [x] Confirmed warning text matches the wording used in teams.ts and teams.net for cross-SDK consistency - [x] Verified at runtime by initializing `App()` without credentials. Output: ``` [WARNING] microsoft_teams.apps.http.http_server: No credentials configured (CLIENT_ID / CLIENT_SECRET / TENANT_ID). Bot will accept unauthenticated requests on /api/messages. ``` Note: Uvicorn's `dictConfig` replaces the default root-logger handler at server-startup, so consumers running through Uvicorn need their own logging config (or `logging.basicConfig(level=WARNING)`) to see this warning. Customers using the standard Agents templates already have logging configured. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Adds support for `suggestedActions/submit` invoke activity - dispatched by the platform when a user clicks an `Action.Submit` suggested-action click. - New `SuggestedActionSubmitInvokeActivity` model and `on_suggested_action_submit` handler. - New `CardActionType.SUBMIT` enum value for constructing outbound suggested-action chips. - Marked `@experimental("ExperimentalTeamsSuggestedAction")` until the platform feature stabilizes. - New `examples/suggested-actions` sample app. <img width="1017" height="243" alt="image" src="https://github.com/user-attachments/assets/6a55d339-9cef-4d88-ae9d-0654388b1335" />

## Summary Make `ctx.send()` and `ctx.reply()` stay private by default when the inbound Teams message was targeted. ## Why This matches the TS SDK behavior and saves app authors from manually wiring `with_recipient(..., is_targeted=True)` for the common private slash-command response path. ## Interesting bits - Explicit public replies still work by passing a non-targeted recipient. - Sends to a different conversation do not inherit targeted routing. - Added typed `quotedReply` and `targetedMessageInfo` entities so the targeted reply metadata is modeled instead of shoved in as dict soup. - Updated the targeted messages example with `send private` / `send public` commands. ## Tips for reviewers Start with `packages/apps/src/microsoft_teams/apps/routing/activity_context.py`, then the new tests in `packages/apps/tests/test_activity_context.py`. ## Test plan <img width="680" height="332" alt="image" src="https://github.com/user-attachments/assets/f9ea6559-96d5-490f-959d-f734e2e20b82" />

…#441) ## Summary `uvx pip-audit` flagged a critical CVE in `starlette` 1.0.0 (transitive via `fastapi`). This PR bumps it to **1.1.0** via `uv lock --upgrade-package starlette` (uv picked 1.1.0, well above the 1.0.1 fix). - **PYSEC-2026-161** / **CVE-2026-48710** / **GHSA-86qp-5c8j-p5mr** — *BadHost* - Disclosed 2026-05-22 by X41 D-Sec - Severity: 9.8 critical - Starlette reconstructs the request URL from the `Host` header without validation. Attackers can inject path segments via the host part, causing `request.url.path` to diverge from the actual routed path. Auth checks that rely on `request.url.path` can be bypassed while routing still hits the protected route. - Fix: starlette 1.0.1+; we landed on 1.1.0 Lock-only change. `fastapi 0.135.2`'s starlette constraint already allowed the bump, so no `pyproject.toml` edits. ## Vulnerabilities not addressed in this PR `pip-audit` and Dependabot alert #5 also flag **jsonpickle 1.4.2** (CVE-2020-22083, GHSA-j66q-qmrc-89rx). - Transitive via `botbuilder-core 4.17.0`, which pins `jsonpickle<1.5,>=1.2`. We cannot bump jsonpickle without overriding an upstream constraint on an archived library. - The advisory itself is disputed: *"This CVE is disputed by the project author as intended functionality."* It describes the documented pickle-deserialization-is-dangerous property, not a code defect. First patched version: none. - Recommendation: treat as accepted risk for now; track separately whether to override the constraint or remove the botbuilder integration. ## Test plan - [x] `uvx pip-audit -r <exported requirements> --disable-pip --no-deps` — starlette no longer in findings; only jsonpickle remains - [x] `poe check` (ruff format + lint) — clean - [x] `poe test` — 609 passed - [x] `pyright` — 0 errors, 0 warnings Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>

corinagum and others added 20 commits May 4, 2026 15:31

Bump version to 2.0.12-dev (#429)

75ece0d

Merge main into release

b78bde6

corinagum changed the title ~~Release 2.0.12: merge main into release (QR included)~~ Release 2.0.12: merge main into release May 27, 2026

lilyydu approved these changes May 27, 2026

View reviewed changes

corinagum merged commit 0652350 into release May 27, 2026
4 checks passed

corinagum deleted the cg/prep-release-2.0.12 branch May 27, 2026 22:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Release 2.0.12: merge main into release#442

Release 2.0.12: merge main into release#442
corinagum merged 20 commits into
releasefrom
cg/prep-release-2.0.12

corinagum commented May 27, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

corinagum commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What's in this release (delta from 2.0.11)

Quoted Replies inclusion notes

Conflict resolution

Test plan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

corinagum commented May 27, 2026 •

edited

Loading