Python: Bump the agent-framework group in /python/packages/lab with 2 updates

[dependabot]

Bumps the agent-framework group in /python/packages/lab with 2 updates: agent-framework-core and agent-framework-openai.

Updates agent-framework-core from 1.20.0 to 1.21.0

Release notes

Sourced from agent-framework-core's releases.

python-1.21.0

[1.21.0] - 2026-10-08

Added

• agent-framework, agent-framework-core, agent-framework-purview: Add tool-result standing guidance, expose rewritten variable-expansion arguments, and support full-buffer Purview policy evaluation for streamed responses (#8784, #8506, #8702)
• agent-framework-openai: Add the maximum reasoning-effort option (#8857)
• agent-framework-oracle: Add the alpha Oracle native vector-store connector (#8676)
• samples: Demonstrate group-chat response filtering and expand the get-started sample progression (#9005, #9133)

Changed

• agent-framework-core, agent-framework-foundry, agent-framework-github-copilot: Isolate provider-owned service session state when agents are invoked as tools (#8853)
• agent-framework-anthropic: Update the Anthropic SDK to 1.11 and adapt Anthropic and Bedrock client behavior (#9119)
• agent-framework-github-copilot: Update the GitHub Copilot SDK to 1.0.16 (#9135)
• agent-framework-devui: Update source-map-js, Radix UI Scroll Area, tailwind-merge, Tailwind CSS and its Vite plugin, and patch brace-expansion 1.x (#9104, #9154, #9155, #9156, #8888)
• agent-framework-azure-contentunderstanding, agent-framework-azure-cosmos-memory, samples: Normalize Foundry project endpoint configuration and examples (#9070)
• agent-framework-foundry: Clarify Foundry agent-tool ownership and lifecycle behavior (#8852)
• agent-framework-foundry-hosting: Warn against hosting a WorkflowAgent through the agent= shortcut (#9146)
• agent-framework-hyperlight, agent-framework-monty: Warn when CodeAct tools cannot support FIDES security enforcement (#9175)
• agent-framework-hosting: Persist the session in the hosting quickstart (#9030)
• docs: Add the AI-assisted contribution policy and issue-first contribution workflow (#9134)
• samples: Update multidict and source-map-js lockfiles and make file-access samples type-check on Windows (#9105, #9145, #9161)
• tests: Update Python GitHub Actions dependencies (#9038, #9039, #9158)
• tests: Isolate the mixed-middleware warning assertion (#9001)
• tests, samples: Refresh Python development dependencies and type-checker compatibility (#9190)

Fixed

• agent-framework-core: Run local sibling tools in declaration-only mixed batches, serialize shared file edits, correct data URI validation and media detection, warn when streamed result gates lack buffering, and handle flat function mappings in progressive tool-name checks (#9050, #9032, #8918, #9029, #9117)
• agent-framework-ag-ui, agent-framework-core: Close delegated provider streams when public streams are released while preserving primary failures during cleanup (#9100)
• agent-framework-declarative: Preserve falsy values returned by Power Fx Search() (#8974)
• agent-framework-devui: Page checkpoint item listings and scope function approvals to their conversations (#9126, #9180)
• agent-framework-gemini, agent-framework-ollama: Close SDK streams when consumers stop early (#9144)
• agent-framework-hosting: Avoid retaining per-session locks after runs complete (#9172)
• agent-framework-hosting-responses: Parse input messages that omit the optional type field (#9124)
• agent-framework-openai: Preserve streamed log probabilities across empty chunks (#8997)
• agent-framework-orchestrations: Reject unknown group-chat participants and sanitize generated handoff tool names (#9026, #9035)
• agent-framework-foundry-hosting: Preserve Foundry Toolbox container-file citations and refresh stale Toolbox call IDs (#9055, #9059)
• agent-framework-typesafe: Honor proxy environment variables in connector-owned clients (#8984)
• agent-framework-bedrock: Preserve extended-thinking reasoning content across tool calls (#8936)
• agent-framework-tools: Preserve table-formatted output in persistent PowerShell sessions (#9043)

Full Changelog: python-1.20.0...python-1.21.0

Commits

• c47da07 Python: scope Secure MCP URL headers to origin (#8285)
• e0162ab .NET: Canonicalize Hyperlight sandbox fingerprints (#8295)
• 119c795 Python: [BREAKING] Scope Redis history storage keys (#8236)
• 2497597 test(python): validate local shell approval binding (#8233)
• 595aa8a Python: Isolate Anthropic request parsing state (#8237)
• c1f33df Simplify CODEOWNERS rules (#8296)
• 4e02083 .NET: Update version for 1.21.0 release (#8297)
• c744b16 .Net + Python: [BREAKING] Limit MCP skill archives to the ZIP format (#8290)
• e1c849c .NET: deps/ai extensions (#8270)
• e4309e5 .NET: Add Foundry hosted session client samples (#8227)
• Additional commits viewable in compare view

Updates agent-framework-openai from 1.15.0 to 1.16.0

Release notes

Sourced from agent-framework-openai's releases.

python-1.16.0

[1.16.0] - 2026-08-27

Added

• agent-framework-core: Add configurable timeouts for waiting on the first background-agent task completion (#7908)
• agent-framework-core: Allow programmatic OpenTelemetry service metadata, resource attributes, and OTLP exporter configuration (#7703)

Changed

• agent-framework-foundry-hosting: Update Agent Server dependencies and expose parent FoundryToolbox constructor options (#7921)
• samples: Apply ChatKit attachment lifecycle checks consistently in the end-to-end sample (#7846)

Fixed

• agent-framework-ag-ui, agent-framework-foundry-hosting: Preserve backend-owned service-session snapshots and validate incremental provider continuation input (#7770)
• agent-framework-anthropic, agent-framework-mistral: Preserve unmapped provider finish reasons (#7850)
• agent-framework-azure-ai-search: Preserve the kinds of heterogeneous knowledge sources (#7875)
• agent-framework-core: Prevent workflow checkpoints from being mutated outside storage implementations (#7847)
• agent-framework-core: Discard unsafe Content fields during deep copy (#7903)
• agent-framework-core: Avoid mutating caller input in SerializationMixin.from_dict() (#7901)
• agent-framework-core: Keep the private agent-loop iteration marker out of provider SDK requests (#7860)
• agent-framework-gemini: Preserve unmapped finish reasons and attach usage details to the correct response (#7837)
• agent-framework-openai: Preserve streaming when GenAI instrumentation replaces the raw SDK response (#7705)

Commits

• 2aa267e .NET: Updating version for dotnet release 1.16.0 (#7441)
• 6a3d535 .NET: Add regression tests and sample guidance for stable agent IDs in checkp...
• 73f48d2 .NET: Add FileMemoryProvider sample to 02-agents/AgentWithMemory (#7401)
• 28389df Python: Move SessionStore to core and persist Foundry Responses sessions (#7306)
• 143386f Python: fix(core): restrict unpickler module-prefix allowlist to types only (...
• 47c8e29 Python: Add FileMemoryProvider context provider sample (#7428)
• 51615d5 Fix DevFlow review comment trigger (#7434)
• 12b2893 Python: Apply header_provider headers to the MCP initialize handshake and oth...
• 93e8cb2 Python: make SerializationMixin.from_dict enforce the documented type check (...
• b64a2e2 Python: add feature-usage User-Agent telemetry (#7420)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.