Python: Bump Python package versions for 1.13.0 release

[Giles Odigwe (giles17)]

Motivation & Context

Prepare the Python 1.13.0 release from the merged changes since Python 1.12.1. The release publishes cross-package feature-usage telemetry and the latest core, provider, workflow, hosting, and MCP skills improvements while keeping package versions aligned with their lifecycle stages.

Description & Review Guide

• What are the major changes? Add the 1.13.0 CHANGELOG section and footer links; bump root and core to 1.13.0, OpenAI to 1.12.0, stable packages by patch where applicable, and alpha/beta packages to the 260730 date stamp; raise agent-framework-core floors conservatively across co-released packages; regenerate uv.lock.
• What is the impact of these changes? All 37 Python package projects receive publishable versions for this release because each has shipped changes represented in the CHANGELOG. The root package remains exactly pinned to the co-released core version. No optional beta cohort bump was applied.
• What do you want reviewers to focus on? Verify CHANGELOG coverage and categorization, stable-package semver choices, prerelease date stamps, conservative core-floor updates, and root/core pin alignment.

Related Issue

This release-preparation PR is not associated with a single issue.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is breaking, add the breaking change label or put [BREAKING] in the title prefix, before or after a language prefix such as Python: or .NET: — workflows keep the label and the title prefix in sync automatically (see .github/workflows/label-title-prefix.yml and .github/workflows/label-pr.yml).

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	47343	4529	90%

report-only-changed-files is enabled. No files were changed during this commit :)

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
9742	34 💤	0 ❌	0 🔥	2m 39s ⏱️

[Copilot]

Pull request overview

Prepares the Python workspace for the 1.13.0 release by updating package versions, aligning most agent-framework-core dependency floors, and adding the corresponding 1.13.0 section and link references to the Python CHANGELOG.

Changes:

• Bump the root agent-framework and agent-framework-core package versions to 1.13.0 and keep the root pinned to the co-released core.
• Stamp alpha/beta packages to the 260730 prerelease date and apply patch bumps for selected stable packages (e.g., foundry, declarative, orchestrations, github_copilot, ag-ui).
• Add the 1.13.0 release notes section to python/CHANGELOG.md and update footer compare links.

Reviewed changes

Copilot reviewed 39 out of 40 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
python/pyproject.toml	Bumps root version to 1.13.0 and pins agent-framework-core[all]==1.13.0.
python/CHANGELOG.md	Adds 1.13.0 release notes and updates footer compare links.
python/packages/core/pyproject.toml	Bumps core version to 1.13.0.
python/packages/openai/pyproject.toml	Bumps package to 1.12.0 and raises agent-framework-core floor to >=1.13.0.
python/packages/foundry/pyproject.toml	Patch bump and raises agent-framework-core floor to >=1.13.0.
python/packages/foundry_local/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/foundry_hosting/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/tools/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/redis/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/purview/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/orchestrations/pyproject.toml	Patch bump and raises agent-framework-core floor to >=1.13.0.
python/packages/ollama/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/monty/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/mistral/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/mem0/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/lab/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/hyperlight/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/hosting/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/hosting-telegram/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/hosting-responses/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/hosting-mcp/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/hosting-a2a/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/github_copilot/pyproject.toml	Patch bump and raises agent-framework-core floor to >=1.13.0.
python/packages/gemini/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/durabletask/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/devui/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/declarative/pyproject.toml	Patch bump and raises agent-framework-core floor to >=1.13.0.
python/packages/copilotstudio/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/claude/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/chatkit/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/bedrock/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/azurefunctions/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/azure-cosmos/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/azure-cosmos-memory/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/azure-contentunderstanding/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/azure-ai-search/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/anthropic/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.
python/packages/ag-ui/pyproject.toml	Patch bump and raises agent-framework-core floor to >=1.13.0.
python/packages/a2a/pyproject.toml	Prerelease bump and raises agent-framework-core floor to >=1.13.0.

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 69%

✗ Correctness

Two release-blocking packaging issues: a declared breaking change is shipped under minor/patch versions, and hosting-responses still pins the previous hosting alpha despite their co-released feature.

✓ Security Reliability

This is a mechanical release-versioning PR and most of it is consistent with the stated rationale. Two things stand out from the diff itself. First, agent-framework-hosting is bumped to 1.0.0a260730, but the four packages that consume it (hosting-a2a, hosting-mcp, hosting-responses, hosting-telegram) keep an exact pin of agent-framework-hosting==1.0.0a260721 — those context lines are visible unchanged in the diff hunks. Published together, the new a260730 builds of those packages would install the previous hosting build, which is at odds with the CHANGELOG entry that lists agent-framework-hosting and agent-framework-hosting-responses as co-changed for #7306. Second, the regenerated uv.lock silently downgrades agentlightning from 0.3.0 to 0.2.2 (new sdist/wheel hashes, aiologic/gpustat/gunicorn/portpicker/uvicorn-worker dropped, httpdbg reintroduced) — a supply-chain-relevant rollback that the PR description does not mention and that a pure version-bump regeneration should not produce. The widespread stripping of sys_platform markers throughout the lock also suggests it was regenerated under different resolver settings than the previous lock. The changes are dominated by marker simplification (dropping the sys_platform == 'darwin' or 'linux' or 'win32' disjunctions, which are equivalent within the previously enumerated environment set) plus resolver-driven graph changes: blessed, jinxed, gpustat, and nvidia-ml-py entries are removed and a new httpdbg 2.1.8 entry is added. The only thing worth a second look is that a version-bump PR pulls a brand-new package into the locked dependency graph; that is a supply-chain surface change that should be intentional rather than incidental.

✓ Test Coverage

No actionable issues found in this dimension.

✓ Failure Modes

This is a mechanical version-bump/lock-regeneration PR, and the pyproject.toml changes look internally consistent (core 1.13.0, root pinned to agent-framework-core[all]==1.13.0, prerelease date stamps all moved to 260730). One thing in the regenerated python/uv.lock looks like an unintended side effect rather than a version bump: agentlightning is downgraded from 0.3.0 (upload-time 2025-12-24) back to 0.2.2 (upload-time 2025-11-12), with its dependency set changing (loses aiologic, gpustat, gunicorn, portpicker, uvicorn-worker; regains httpdbg) and ansicon dropped from the lock entirely. This is accompanied by a repo-wide stripping of the sys_platform == 'darwin' or ... 'win32' markers from every locked dependency, which together suggests the lock was regenerated under a different uv version or a different resolution environment than the one that produced the current lock. Since this lock is the release artifact, a silent dependency rollback plus loss of platform-scoping is worth confirming before publishing.

✓ Design Approach

This is a release version-bump PR. Two things stand out from the diff itself. First, agent-framework-hosting is bumped from 1.0.0a260721 to 1.0.0a260730, but the four dependent hosting packages (hosting-a2a, hosting-mcp, hosting-responses, hosting-telegram) keep an exact pin agent-framework-hosting==1.0.0a260721, so the newly-published hosting build would never be installed by any consumer, and the CHANGELOG lists hosting and hosting-responses as co-changed in #7306. Second, the regenerated uv.lock strips platform markers throughout and silently downgrades agentlightning from 0.3.0 to 0.2.2 (dropping aiologic/gpustat/gunicorn/portpicker/uvicorn-worker and removing the ansicon entry), which suggests the lock was regenerated under different resolution settings/uv version rather than a plain version-bump relock.

Flagged Issues

• python/packages/hosting-responses/pyproject.toml:27 pins the previous hosting alpha, excluding the co-released hosting implementation.

---

Automated review by giles17's agents

[github-actions]

Flagged issue

python/packages/hosting-responses/pyproject.toml:27 pins the previous hosting alpha, excluding the co-released hosting implementation.

---

Source: automated DevFlow PR review

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 73%

✓ Correctness

No actionable issues found in this dimension.

✓ Security Reliability

This portion of the change is entirely python/uv.lock churn. Two kinds of changes are visible: (1) mass removal of sys_platform == 'darwin' or sys_platform == 'linux' or sys_platform == 'win32' markers from dependency entries, and (2) package additions/removals (httpdbg added at the new hunk around line 3113; blessed, jinxed, gpustat, nvidia-ml-py removed) that are downstream consequences of the agentlightning version rollback already raised in the existing unresolved review threads on this file. Beyond the platform-marker stripping, the diff also widens or drops non-platform markers: culsans loses python_full_version < '3.13' on aiologic/typing-extensions (line 2249-2250), clr-loader loses python_full_version < '3.14' on cffi (line 1985), and litellm[proxy] changes pyroscope-io/uvloop from sys_platform == 'darwin' or sys_platform == 'linux' to sys_platform != 'win32'. These are semantic environment changes rather than pure noise, and they reinforce that the lock was regenerated under a different uv version/resolution environment than the committed one. Since the lock is what the 1.13.0 release is validated against, that is worth confirming, but I did not find any new security or correctness defect in this portion that is not already covered by the open threads.

✓ Test Coverage

No actionable issues found in this dimension.

✓ Failure Modes

No actionable issues found in this dimension.

✓ Design Approach

No actionable issues found in this dimension.

Suggestions

• Regenerate python/uv.lock using the repository's expected uv version and resolution-environment settings. The current diff removes Python-version constraints from culsans and clr-loader dependencies and widens litellm[proxy] platform markers, producing semantic dependency changes unrelated to the intended version bumps.

---

Automated review by giles17's agents

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 55%

✓ Correctness

The lockfile metadata was not fully regenerated after dependency constraint changes.

✓ Security Reliability

This is a release-preparation PR consisting entirely of version bumps in pyproject.toml files, a CHANGELOG section, and a regenerated uv.lock. Reviewing from a security/reliability angle, the changes contain no code, no new dependencies, no credentials, and no new trust boundaries — the only reliability-relevant risks are version-pin inconsistencies. Reading the diff, the previously-raised inconsistencies are resolved in the current state: hosting-a2a, hosting-mcp, hosting-responses, and hosting-telegram now all pin agent-framework-hosting==1.0.0a260730 matching the bumped hosting package; azurefunctions raises its agent-framework-durabletask floor to >=1.0.0b260730 matching the co-released durabletask; the root package pins agent-framework-core[all]==1.13.0 matching core; and the agentlightning lock rollback previously flagged is not present in this diff. Note: my file-read and shell tooling was denied in this session, so I could not perform the usual out-of-diff verification pass; I have therefore withheld any finding that would require reading files beyond the diff, and I report no findings rather than speculative ones.

✓ Test Coverage

No test-coverage issues found. This PR changes release metadata, dependency floors, and lockfile versions without introducing runtime behavior that requires new tests.

✓ Failure Modes

I was unable to complete a verification pass: every file-read and search tool call in this session was rejected by the environment (permission errors on view/grep/bash), so I could not open any repo files to confirm or refute candidate findings. Based on the diff alone, this is a mechanical release bump: package versions advance, agent-framework-core floors are raised to >=1.13.0,<2 across co-released packages, the root package keeps its exact pin to the co-released core (agent-framework-core[all]==1.13.0), and the CHANGELOG gains a 1.13.0 section with correct footer links ([Unreleased] now compares from python-1.13.0 and [1.13.0] compares 1.12.1...1.13.0). The previously-flagged stale agent-framework-hosting==1.0.0a260721 pins are resolved in this diff: hosting-a2a, hosting-mcp, hosting-responses, and hosting-telegram all now pin ==1.0.0a260730, matching the bumped hosting package, and azurefunctions raises its durabletask floor to >=1.0.0b260730. I am reporting zero findings rather than speculating about unverified cross-package constraints (e.g. core's optional-dependency extras or the uv.lock third-party closure), since I could not read those files.

✓ Design Approach

This is a mechanical release-preparation change: CHANGELOG 1.13.0 section plus footer links, version bumps across all 37 Python package projects, conservative agent-framework-core>=1.13.0,<2 floors, co-release pin alignment for the hosting family and durabletask, and a regenerated uv.lock. The prior review threads about stale agent-framework-hosting==1.0.0a260721 pins are addressed in the current diff (hosting-a2a, hosting-mcp, hosting-responses, hosting-telegram all now pin ==1.0.0a260730), and azurefunctions now flors durabletask at >=1.0.0b260730. The one remaining design-level question is the version increment chosen for the stable packages that carry the entry the PR itself marks [BREAKING]: agent-framework-ag-ui moves 1.0.0 -> 1.0.1 (patch) and agent-framework-core 1.12.1 -> 1.13.0 (minor), while the CHANGELOG preamble in the same file states the project adheres to Semantic Versioning. I could not open repository files during this pass (tool access was denied), so this is reported from diff-visible content only and is non-blocking.

---

Automated review by giles17's agents