Python: Build(deps): Bump agent-framework-core from 1.17.0 to 1.18.0 in /python/packages/lab

[dependabot]

Bumps agent-framework-core from 1.17.0 to 1.18.0.

Release notes

Sourced from agent-framework-core's releases.

python-1.18.0

[1.18.0] - 2026-09-10

Added

• samples: Add Magentic custom-manager prompts and MLflow observability examples (#7876, #8085)
• agent-framework-core: Add shared vector-store abstractions, portable filters, and an in-memory vector store (#8014, #8115)
• agent-framework-core: Add a maximum-duration bound and stop-reason signal to the tool invocation loop (#7772)
• agent-framework-core: Support mixed workflow invocation keyword arguments (#7963)
• agent-framework-ag-ui: Add emit_messages_snapshot configuration for suppressing the terminal message snapshot (#7808)
• agent-framework-ag-ui, agent-framework-core: Add supported MCP Host-history conversion for persisted AG-UI conversations (#8130)
• agent-framework-azure-ai-search, agent-framework-core: Add an Azure AI Search implementation of the shared vector-store APIs (#8153)
• agent-framework-redis, agent-framework-core: Add Redis HASH and JSON vector stores (#8156)
• agent-framework-qdrant: Add the alpha Qdrant vector-store connector (#8154)
• agent-framework-postgres: Add the alpha PostgreSQL/pgvector connector (#8155)

Changed

• agent-framework, agent-framework-core, agent-framework-foundry, agent-framework-lab: [BREAKING] Isolate Lab dependency resolution, remove Lab from core[all], and support Azure AI Projects through 2.6 with OpenAI 3.x (#8188)
• agent-framework-core: [BREAKING - experimental] Add ranged file reads and move the line-numbering contract onto AgentFileStore (#7669)
• agent-framework-core: [BREAKING - experimental] Centralize file, memory, session, and skill path normalization (#8123)
• agent-framework-anthropic, agent-framework-azure-ai-search, agent-framework-azure-cosmos, agent-framework-bedrock, agent-framework-copilotstudio, agent-framework-core, agent-framework-foundry, agent-framework-gemini, agent-framework-mem0, agent-framework-openai: [BREAKING] Make SecretString a masked value wrapper rather than a str subclass and align provider credential handling (#8127)
• agent-framework-github-copilot: [BREAKING] Make workspace file hooks opt-in and document enable_file_hooks migration (#7517)
• agent-framework-foundry-hosting: [BREAKING - beta] Restrict checkpoint deserialization by default and allow applications to register additional checkpoint types (#8045)
• agent-framework-core, agent-framework-foundry: Move Foundry evaluation serialization into the Foundry integration (#8031)
• agent-framework-github-copilot: Update the GitHub Copilot SDK dependency to 1.0.11 and align file-operation behavior (#8002)
• agent-framework-ag-ui, agent-framework-devui: Expand compatibility through FastAPI 0.141 (#8052)
• agent-framework-core, agent-framework-hyperlight: Update Hyperlight Sandbox to 0.6 and enable supported Python 3.14 installations (#8174)
• agent-framework-foundry, agent-framework-foundry-hosting, agent-framework-openai: Lazily load Foundry and OpenAI integrations to avoid unnecessary import-time dependencies (#8219)
• agent-framework-devui: Update frontend transitive dependencies (#8019, #8009, #8175)
• agent-framework: Replace stale Python documentation placeholders with live documentation links (#7777)
• docs: Repair external links, document anonymous Parallel Search MCP usage, and correct Python documentation wording (#8090, #8084, #7942)
• tests: Update uv, Ruff, Zuban, ty, pytest, and Python type-checking dependencies; isolate Lab test dependencies; and make the optional Lightning test robust to nested import failures (#8038, #8036, #8037, #8062, #8110, #8064, #8071, #8209, #8207, #8208)

Fixed

• agent-framework-purview: Request inline policy evaluation while the protection-scope cache is cold (#7976)
• agent-framework-anthropic, agent-framework-gemini: Wrap provider SDK failures consistently in ChatClientException (#7855)
• agent-framework-a2a: Avoid AttributeError and preserve caller ownership when an A2AAgent uses a supplied HTTP client (#8095, #7951)
• agent-framework-chatkit: Preserve ChatKit input tags when converting user messages (#8097)
• agent-framework-claude, agent-framework-github-copilot: Reject MCP servers passed through provider-agent tool collections (#7835)
• agent-framework-claude: Preserve message roles in Claude prompt history (#8122)
• agent-framework-declarative: Preserve URL query parameters and correctly route DevUI message input in declarative workflows (#7765, #7839)
• agent-framework-core: Preserve runtime raw representations and recursively serialize nested container values (#8023, #7790)
• agent-framework-core: Scope MCP headers to transport requests, clean up failed HTTP connections, and retain bounded MCP Host payload metadata (#8039, #8126, #8128)
• agent-framework-core: Finalize abandoned functional-workflow streams, restore fan-in edge buffers, and validate checkpoint state when saving (#7798, #7948, #8215)
• agent-framework-core: Include tool trajectory details in summarizer input (#8087)
• agent-framework-core: Preserve the Param unset sentinel with current typing-extensions releases (#8145)
• agent-framework-core: Preserve empty signed Anthropic thinking blocks during streaming replay (#8171)
• agent-framework-core: Revalidate discovered skill paths immediately before use (#8151)
• agent-framework-core: Isolate FIDES state per session, enforce labels on expanded variables, preserve confidentiality through security tools, and keep MCP labels subordinate to local policy (#8138, #8139, #8141, #8187)
• agent-framework-ag-ui: Stamp checkpoint ownership, surface workflow intermediate events as reasoning, and preserve function-call/result ordering (#8011, #8003, #8005)
• agent-framework-ag-ui: Scope internal session identifiers and reject empty scope-resolver results (#8158, #8197)

... (truncated)

Commits

• 4ce2804 .NET: Fix release build analyzer failures (#7721)
• 1b45c15 .NET: Update version for 1.18.0 release (#7713)
• 00d7102 Python: fix(workflows): preserve all trace contexts in FanInEdgeRunner aggreg...
• d80c340 Clarify function-loop spec update guidance (#7706)
• af4347a Python: Restrict workflow type deserialization (#7500)
• a445e48 Bump ty from 0.0.64 to 0.0.70 in /python (#7644)
• 8b8fbbb Bump flit from 3.12.0 to 4.0.2 in /python (#7645)
• 925d722 Python: clarify skill script argument guidance (#7695)
• 6001c12 .NET: Fix declarative workflows deep research sample (#7674)
• 6a3633e Python: Add a global workflow checkpoint type registry (#7636)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.