Semantic Kernel 1.45.0 Tightens HTTP and Connector Boundaries

What shipped

Microsoft Semantic Kernel’s Python 1.45.0 release (6 October 2026) is a small but consequential boundary release for agent integrations. Its official release notes list four changes that affect how untrusted or externally supplied values cross into runtime services:

• OpenAPI plugin requests now pin the validated address.
• Session download filenames are encoded and validated.
• Python and .NET share HTTP request-validation utilities.
• CrewAI task identifiers are validated, and MCP server tool names are made consistent.

The same release also removes an unsupported Copilot Studio service-auth mode. These are implementation and contract changes, not a claim that an application is secure by default.

What I verified

I inspected the official 1.45.0 release page and its published “What’s Changed” list. The page identifies the release as python-1.45.0, dated 6 October 2026, and names the relevant changes above. I did not build Semantic Kernel, exercise an OpenAPI plugin against a rebinding endpoint, or run a session-download or CrewAI integration test here.

Why it matters

Agent systems routinely turn model- or user-influenced strings into URLs, filenames, task identifiers, and tool names. Validating a value once and then using a different representation or resolution path is a classic boundary failure. The release notes show that Semantic Kernel is moving these checks into shared/runtime paths rather than leaving every connector to improvise. Operators should still test the exact deployed connector and transport: a release-note item is evidence of a code change, not proof of complete request isolation.

Reproduction target

For a meaningful deployment check, exercise four cases with the project’s own tests or a small isolated harness: an OpenAPI URL whose resolved address changes, a download filename containing traversal and encoding edge cases, malformed CrewAI task identifiers, and MCP tool names containing characters that previously diverged between server and client paths. Record both rejection behavior and the final outbound request/filename; do not use production credentials or reachable internal services in the test.