Copilot 87c9d74bd7 Python: Fix: Verify types during checkpoint deserialization to prevent marker spoofing (#3243) ...

* Initial plan

* Add validation for reserved keywords in checkpoint encoding/decoding

Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>

* Refactor to eliminate duplicate code in model protocol detection

Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>

* Fix pyright type narrowing issue for dataclass check

Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>

* Add comprehensive unit tests for checkpoint encoding

Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>

* Remove serialization-time reserved keyword validation to fix failing tests

The serialization-time validation was too aggressive and blocked legitimate use cases
where encoded data was being re-encoded. Security is now enforced only at deserialization
time by validating that classes marked with DATACLASS_MARKER are actual dataclasses and
classes marked with MODEL_MARKER actually support the model protocol.

Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>

* Apply ruff formatting to checkpoint encoding file

Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>

* Changes before error encountered

Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>

* Revert "Changes before error encountered"

This reverts commit f515b880dc.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: TaoChenOSU <12570346+TaoChenOSU@users.noreply.github.com>
Co-authored-by: Tao Chen <taochen@microsoft.com>

87c9d74bd7 · 2026-01-22 19:07:39 +00:00

History

..

a2a

Python: [Breaking] Simplified Content types to a single class with classmethod constructors. (#3252)

2026-01-20 22:09:39 +00:00

ag-ui

Python: fix(ag-ui): properly handle json serialize with handoff workflows as agent (#3275)

2026-01-21 02:43:14 +00:00

anthropic

Python: feat(anthropic): Add response_format support for structured outputs (#3301)

2026-01-21 15:08:13 +00:00

azure-ai

Set min version of dependent azure-ai-projects to 2.0.0b3 (#3347)

2026-01-22 12:56:25 +09:00

azure-ai-search

Python: Update package version (#3258)

2026-01-16 21:06:30 +00:00

azurefunctions

Python: [Breaking] Simplified Content types to a single class with classmethod constructors. (#3252)

2026-01-20 22:09:39 +00:00

bedrock

Python: [Breaking] Simplified Content types to a single class with classmethod constructors. (#3252)

2026-01-20 22:09:39 +00:00

chatkit

Python: [Breaking] Simplified Content types to a single class with classmethod constructors. (#3252)

2026-01-20 22:09:39 +00:00

copilotstudio

Python: [Breaking] Simplified Content types to a single class with classmethod constructors. (#3252)

2026-01-20 22:09:39 +00:00

core

Python: Fix: Verify types during checkpoint deserialization to prevent marker spoofing (#3243)

2026-01-22 19:07:39 +00:00

declarative

Python: [Breaking] Simplified Content types to a single class with classmethod constructors. (#3252)

2026-01-20 22:09:39 +00:00

devui

Python: [Breaking] Simplified Content types to a single class with classmethod constructors. (#3252)

2026-01-20 22:09:39 +00:00

foundry_local

Python: Update package version (#3258)

2026-01-16 21:06:30 +00:00

lab

Python: [Breaking] Simplified Content types to a single class with classmethod constructors. (#3252)

2026-01-20 22:09:39 +00:00

mem0

Python: [Breaking] Simplified Content types to a single class with classmethod constructors. (#3252)

2026-01-20 22:09:39 +00:00

ollama

Python: [Breaking] Simplified Content types to a single class with classmethod constructors. (#3252)

2026-01-20 22:09:39 +00:00

purview

Python: Update package version (#3258)

2026-01-16 21:06:30 +00:00

redis

Python: [Breaking] Simplified Content types to a single class with classmethod constructors. (#3252)

2026-01-20 22:09:39 +00:00