Bump the agent-ai-coupled group with 3 updates - #30
Closed
dependabot[bot] wants to merge 2111 commits into
Closed
Conversation
…pt/capability inspector (Providers) + KV type, env facts, canonical hash contracts (Application) Plan A v8.1 slices 0+1 (Plans/2026-08-16-benchmark-kv-cache-type-plan.md): - ResolveCpuReplayPlan: CPU benchmark replay now carries -c + threads - LlamaServerLaunchProjection.From + ComputeIdentity; argv rendered from it (byte-identical, pinned) - -lv placement probe on benchmark spawns; PlacementOutcome.None + counts - LlamaServerLaunchReceipt on LlamaServerProfilingContext (benchmark spawns, non-throwing) - public ILlamaServerLaunchCapabilityInspector; Replay ordinal K==V - BenchmarkKvCacheType (f16/q8_0/q4_0, Auto, Apply), BenchmarkUnsupportedKvCacheTypeException -> 422 - RuntimeEnvironmentFactsV1 + provider (bundle identity extracted to RuntimeBundleIdentityCalculator, output pinned) - BenchmarkCanonicalJson hash helper, BenchmarkLaunchReceiptCommand, v1 snapshot byte-compat pin
…e badges, receipt diff compare + detail blocks (hand-typed wire seam pending OpenAPI regen)
…MCP-inbound and drafting runs - RunSavedAgentHandler passes Timeouts from MaxMessageRequestTimeoutSeconds (was hardcoded 600s default) - McpAgentRunExecutor bounds SpawnForMcpAsync with a linked CancelAfter and reports failure_code timed_out - DefaultConfigDraftService follows the node setting live; Drafting:GenerationTimeout becomes an optional override - LlamaServerSupervisorOptions.HttpNetworkTimeout default 600s -> 3600s (node setting ceiling) so it never pre-empts - delete dead CentralPlatformOptions.InvocationTimeoutSeconds/ToolCallTimeoutSeconds + appsettings keys
…ma.cpp runtime MEAI's OpenAI adapter maps no TopK and drops unknown AdditionalProperties, so the developer per-send sampling overrides silently did nothing on the default runtime. DeferredLlamaServerChatClient now patches them as top-level body fields via ChatCompletionOptions.Patch (same seam as the thinking switch); shared SamplingOptionKeys replaces the Ollama-only private consts. The sampling dialog disables those four fields with a hint when a cloud model is selected and explains numCtx is a history budget.
…label tools overview as installed-not-offered 13 knobs are seeded once at DI (llama cap/TTL, speculative, cache reuse, orchestration idle, maxResponseSizeMb, Ollama endpoint, HF quant, reranker, defaultModel/maxPendingToolCallAge partially) — the field description and the save toast now say a node restart is required. LocalToolsOverview/ToolsPage copy states that per-turn availability depends on model tool support, ToolCapableModels and the agent's allowed tools.
…rs conversation compaction - RegenerateMessage hub method / RegenerateAsync take SamplingOptions (appended last); React adapter + Chat.tsx forward the same developer-gated overrides the send path uses; byte-identical when absent - CompactionContextResolver shared by send and regenerate: a compacted conversation regenerates from the synopsis + uncovered history instead of the full raw history (guarded when the synopsis covers the answered turn; memory extraction keeps mining real user turns) - fix stale AgentDefinitionModels.ts comment claiming Orchestrator kind is not wired
… the session-approval button when unsupported; delete dead SamplingDefaults/AllowedVoiceModels settings - SessionApprovalEligibility is the one predicate InvocationRunner and the catalog mapper share - LocalChatToolDescriptor/LocalToolCatalogEntry carry IsFixedCustomTool so the catalog can answer for custom tools - ToolCallCard renders 'Approve for this session' only when the catalog says the node will honour it - StoredNodeSettings.SamplingDefaults + AllowedVoiceModels (persisted, never read) removed from store/DTOs/validators; loading an old node-settings.json with those keys is pinned tolerant
…anion BenchmarkModelEligibility rejected any installed model with a Projector member. The HF acquisition path auto-attaches the mmproj companion to modern text models (gemma-4, Qwen3.x), so none of them could be benchmarked. The benchmark is text-only, and the chat runtime already launches such models with --mmproj without changing text generation; keep only the llama.cpp provider and Chat-role checks.
… samplingDefaults/allowedVoiceModels removed)
…launch receipt + environment facts checkpoint, persistence + endpoints
Plan A v8.1 slice 2:
- freeze: KV type via capability inspector + fallback store (Auto strict), 422 UnsupportedKvCacheType, intended LaunchIdentity, judge Auto-only
- executors: admission on frozen runtime ctx; env facts captured pre-spawn; receipt checkpoint before inference (CAS, CancellationToken.None); sanitized failure reason
- persistence: 32 encrypted/plain columns, Mark{Primary,Judge}LaunchReadyAsync insert-if-null CAS (Running v==claimed | Cancelled v==claimed+1), migration AddBenchmarkRunLaunchReceipts + tests
- endpoints: kvCacheType on run start (400 on unknown), summary/detail evidence fields, PlacementOutcome.None => "none" metric
…ence fields; swap FE wire seam to generated types; compare fires on receipt OR environment hash
…and make every premature termination attributable - assistant-queued/streaming events carry InvocationTimeoutSeconds; guardNodeChatStream widens every deadline to max(constant, node timeout + 30s grace) so the browser never pre-empts the node (queue wait, human park, tool round-trip, cloud cold start were all bounded by the 180s constant only) - InvocationRunner.DescribeCancellation: distinct messages for watchdog timeout (names the setting + seconds), user stop, detached-grace reaper, external stop; pre-run queued cancel and tool-result timeout distinguishable too - StreamWatchdogError surfaces as ClientWatchdog with an i18n'd notice
…, 422 hint excludes response-validation errors, intended≠effective for exe drift + judge, compare on any differing launch row, byte ladder, collapsed evidence accordion
…get the raised 3600s floor Embedding calls carry no invocation deadline, so the shared HttpNetworkTimeout raise (G9) would have let a wedged embedding call hang for an hour. EmbeddingHttpNetworkTimeout (default 600s) now bounds CreateEmbeddingGenerator.
…gs (hash-affecting, pre-ship), best-effort checkpoint, one variant/os spelling, flat exe-sha/aux columns for the list path, shared LaunchPolicyFileHashCache, explicit IsQuantized; migration regenerated
…real differences are visible
…ark spawns, PlacementOutcome.None, receipt/checkpoint CAS, string enums in hashed JSON, EF migrations-remove trap)
…, environment-facts hash ignores capture clock
… benchmark/judge spawns (pre-existing since 2026-08-14 — cold benchmark runs and every judge failed with 'profiling launch conflicts with another in-flight admission') CapacityRequest.PublishLaunchAdmission=false keeps the verdict + ledger reservation but skips the ProcessLaunchAdmission the frozen-replay spawn must not consume.
… toward the launch/judge differs banner
…supportedKvCacheType (not every 422)
ModelContextProtocol.AspNetCore takes an exact dependency on the matching ModelContextProtocol build, so the nuget-remaining catch-all could bump one without the other. Dependabot #19 did exactly that (2.2.0 against a pinned 2.0.0) and every project failed restore with NU1107/NU1608 under central transitive pinning. Group the pair the way the Aspire and Agents families already are, and lock the tuple with a test so the split fails locally instead of in CI restore.
eng/ReleaseVersion.props is the single release-identity source. Bump VersionSuffix rc.1 -> rc.2 and refresh the two prose lines that state the current source version (README.md, publish/README.md). Left alone deliberately: skills/xe-local-ai-engine/SKILL.md's app-version-min (a floor, not the current version), the pinned example tag in docs/agentic-support/agent-install.md, historical doc/audit references, and the synthetic versions in release/install test fixtures.
1.0.0-rc.1 was tagged at dfff46c and published as a prerelease on 2026-08-09 but never written down. Its section is reconstructed from the v0.1.0-rc.5.1..v1.0.0-rc.1 range and the published release metadata; the release-pipeline bullets that sat under [Unreleased] belong to it, because they shipped in it. Also: a Public-repository releases table, since the historical table above it is the tester repo's record and stops at 0.1.0-rc.5.1; and the tag convention now names both the 1.0.0-rc.N and the historical rc.N.M forms. [Unreleased] is retitled as the pending 1.0.0-rc.2 and carries the v1.0.0-rc.1..develop delta.
The git-filter-repo scrub prepared alongside e397e82 was never run, and the repository went public on 2026-08-05 carrying the historical dev database key, the 841 untracked .opencode/ and Plans/ files, the deleted encrypted runtime artifacts, the historical opencode.jsonc, and a personal mailbox domain in the author metadata of substantially all ~2,090 commits on develop. Record the owner's 2026-08-23 decision to execute that rewrite before the v1.0.0-rc.2 tag: content purge plus --replace-text for the key value, plus an author/committer remap to the owner's GitHub noreply address, which keeps the contribution graph intact while the personal mailbox leaves the objects. The record states the limits plainly rather than overselling the fix -- existing clones and forks keep the old objects, the server-side GC is GitHub Support's to complete and is not a gate on the tag, every commit id changes (eleven tags and the public Dependabot branches included), and the v1.0.0-rc.1 release manifest keeps binding to a source SHA the rewritten history will not contain. Rotation of any dev DB sealed under the old key is still required. Evidence is marked pending and enumerates what execution must produce. The release checklist's authority gate now blocks the tag while it stays pending. Checklist-bound rather than register-bound: verify-release-authority.py fails closed on any category outside its fixed nine, and the validator is tighten-only.
The report existed only in the message of a commit whose tree was solely runtime-generated images. The history remediation decided in docs/compliance/history-remediation-decision.md prunes that commit, so the text moves into the audits record verbatim before the rewrite runs.
Co-authored-by: w0rldx <20070711+w0rldx@users.noreply.github.com> Signed-off-by: dependabot[bot] <support@github.com>
…E-Local-AI-Engine.Client.React in the frontend-openapi-codegen group across 1 directory (#20) Co-authored-by: w0rldx <20070711+w0rldx@users.noreply.github.com> Signed-off-by: dependabot[bot] <support@github.com>
…6 updates (#21) * build(deps): bump the frontend-runtime group across 1 directory with 6 updates Bumps the frontend-runtime group with 6 updates in the /XE-Local-AI-Engine.Client.React directory: | Package | From | To | | --- | --- | --- | | [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.21` | `1.170.29` | | [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react) | `12.11.0` | `12.11.3` | | [framer-motion](https://github.com/motiondivision/motion) | `12.43.0` | `13.1.0` | | [react-error-boundary](https://github.com/bvaughn/react-error-boundary) | `6.1.2` | `6.1.3` | | [react-joyride](https://github.com/gilbarbara/react-joyride) | `3.1.0` | `3.2.0` | | [zustand](https://github.com/pmndrs/zustand) | `5.0.14` | `5.0.15` | Updates `@tanstack/react-router` from 1.170.21 to 1.170.29 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.29/packages/react-router) Updates `@xyflow/react` from 12.11.0 to 12.11.3 - [Release notes](https://github.com/xyflow/xyflow/releases) - [Changelog](https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md) - [Commits](https://github.com/xyflow/xyflow/commits/@xyflow/react@12.11.3/packages/react) Updates `framer-motion` from 12.43.0 to 13.1.0 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](motiondivision/motion@v12.43.0...v13.1.0) Updates `react-error-boundary` from 6.1.2 to 6.1.3 - [Release notes](https://github.com/bvaughn/react-error-boundary/releases) - [Commits](bvaughn/react-error-boundary@6.1.2...6.1.3) Updates `react-joyride` from 3.1.0 to 3.2.0 - [Release notes](https://github.com/gilbarbara/react-joyride/releases) - [Commits](gilbarbara/react-joyride@v3.1.0...v3.2.0) Updates `zustand` from 5.0.14 to 5.0.15 - [Release notes](https://github.com/pmndrs/zustand/releases) - [Commits](pmndrs/zustand@v5.0.14...v5.0.15) --- updated-dependencies: - dependency-name: "@tanstack/react-router" dependency-version: 1.170.29 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: frontend-runtime - dependency-name: "@xyflow/react" dependency-version: 12.11.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: frontend-runtime - dependency-name: framer-motion dependency-version: 13.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: frontend-runtime - dependency-name: react-error-boundary dependency-version: 6.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: frontend-runtime - dependency-name: react-joyride dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: frontend-runtime - dependency-name: zustand dependency-version: 5.0.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: frontend-runtime ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): regenerate the license manifest for the frontend-runtime bumps The client-react job runs licenses:check, which regenerates third-party-licenses.generated.json and fails on any drift. Dependabot bumps the packages without rerunning the generator, so the committed manifest still named the previous versions of the six updated packages. Only versions move; every license field is unchanged. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: w0rldx <20070711+w0rldx@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: dependabot[bot] <support@github.com>
#23) Signed-off-by: dependabot[bot] <support@github.com>
… directory with 10 updates (#26) Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: w0rldx <20070711+w0rldx@users.noreply.github.com> Signed-off-by: dependabot[bot] <support@github.com>
The itemized exposure inventory moves entirely into the restricted remediation record: enumerating removed material in a committed document would republish the pointers the rewrite exists to remove. The decision, sequence, limits, and evidence obligations are unchanged.
Bumps Microsoft.Agents.AI from 1.17.0 to 1.19.0 Bumps Microsoft.Agents.AI.Workflows from 1.17.0 to 1.19.0 Bumps Microsoft.Extensions.AI from 10.8.3 to 10.9.0 --- updated-dependencies: - dependency-name: Microsoft.Agents.AI dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: agent-ai-coupled - dependency-name: Microsoft.Extensions.AI dependency-version: 10.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: agent-ai-coupled - dependency-name: Microsoft.Agents.AI.Workflows dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: agent-ai-coupled ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
.NET
dependabot
Bot
added
dependencies
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
w0rldx
deleted the
dependabot/nuget/develop/agent-ai-coupled-6e08d372d1
branch
August 23, 2026 21:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated Microsoft.Agents.AI from 1.17.0 to 1.19.0.
Release notes
Sourced from Microsoft.Agents.AI's releases.
1.19.0
What's Changed
New Contributors
Full Changelog: microsoft/agent-framework@dotnet-1.18.0...dotnet-1.19.0
1.18.0
What's Changed
New Contributors
Full Changelog: microsoft/agent-framework@dotnet-1.17.0...dotnet-1.18.0
Commits viewable in compare view.
Updated Microsoft.Agents.AI.Workflows from 1.17.0 to 1.19.0.
Release notes
Sourced from Microsoft.Agents.AI.Workflows's releases.
1.19.0
What's Changed
New Contributors
Full Changelog: microsoft/agent-framework@dotnet-1.18.0...dotnet-1.19.0
1.18.0
What's Changed
New Contributors
Full Changelog: microsoft/agent-framework@dotnet-1.17.0...dotnet-1.18.0
Commits viewable in compare view.
Updated Microsoft.Extensions.AI from 10.8.3 to 10.9.0.
Release notes
Sourced from Microsoft.Extensions.AI's releases.
10.9.0
Version 10.9.0 is headlined by changes in these areas:
RoutingChatClientbase class, withSemanticRoutingChatClientas a concrete semantic-routing implementation. Separately, the abstractFailoverChatClientspecialization and its concreteOrderedFailoverChatClientimplementation add failover routing.Experimental API Changes
New Experimental APIs
EXTEXP0013) #7602MEAI001) #7662What's Changed
AI (
Microsoft.Extensions.AI,Microsoft.Extensions.AI.Abstractions, andMicrosoft.Extensions.AI.OpenAI)Note: Microsoft.Extensions.AI.OpenAI constrains its dependency for OpenAI to 2.12.x, preventing OpenAI updates to 2.13.0+ due to an incompatibility. We expect to release Microsoft.Extensions.AI.OpenAI version 10.9.1 during the week of August 17 to address this issue.
HTTP Resilience and Diagnostics (
Microsoft.Extensions.Http.ResilienceandMicrosoft.Extensions.Http.Diagnostics)ASP.NET Core Extensions (
Microsoft.AspNetCore.Diagnostics.Middleware)Logging Source Generator (
Microsoft.Gen.Logging)AI Evaluation (
Microsoft.Extensions.AI.Evaluation.Reporting)Project Templates (
Microsoft.McpServer.ProjectTemplates)... (truncated)
10.8.4
This servicing update refreshes the .NET AI project templates ahead of the July 30, 2026 retirement of GitHub Models — removing the GitHub Models provider option and updating template dependencies.
As a result, both the AI Chat Web (
aichatweb) and AI Agent Web API (aiagent-webapi) templates now require the AI service provider to be chosen explicitly via--provider; there is no longer a default. One of the following must be selected:--provider azureopenai— Azure OpenAI--provider ollama— Ollama (for local development)--provider openai— OpenAI PlatformPackages in this release
What's Changed
Project templates
--provideroption is now required with no default (#7667).Aspire.Hosting.AppHostto13.4.6andCommunityToolkit.VectorData.SqliteVecto1.0.0-preview.4(alignedSystem.Linq.AsyncEnumerableto10.0.9), replacing earlier workaround package pins (#7639).Full Changelog
Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions