Microsoft Semantic Kernel 1.82 tightens AI tool access
Microsoft has released Semantic Kernel .NET 1.82.0 with tighter controls around database changes, outbound HTTP requests and local file access. For teams already using its plugins, the practical question is whether existing integrations still work with the new requirements.
The official release is dated November 7, and NuGet lists version 1.82.0 as available. Semantic Kernel is Microsoft’s SDK for connecting language models with application code and tools. This update concerns the .NET release and particular plugin interfaces; its autogenerated release page also contains Python changes that should not be mistaken for .NET features.
Teams also using Microsoft’s separate Python agent framework can consult ByteForward’s Agent Framework 1.25 migration guide. Its upgrade requirements apply to that Python framework; the changes here concern Semantic Kernel’s .NET SDK.
Database writes need explicit application logic
The structured-data plugin’s convenience factory now defaults to queries. Insert, update and delete operations require functions that the application configures explicitly. Legacy overloads that accept persistence entities directly remain present for compatibility, but reject use rather than perform mutations.
The replacement APIs separate the model’s request from the Entity Framework entity stored in the database. Developers supply the mapping for inserted or updated data, and application-controlled lookup logic selects the tracked entity that an update or deletion can affect. The change is documented in Microsoft’s mutation-boundary pull request.
The updated sample uses product IDs when changing or deleting records. Its row-selection queries are also where an application can add tenant or owner restrictions. That is a migration requirement developers must implement for their own data model. The library cannot infer which customer’s records a particular caller is entitled to change.
HTTP checks follow the connection
HttpPlugin now carries the IP addresses that passed its checks into connection setup. Previously, the built-in transport did not keep those addresses when opening a connection.
The HTTP update retains the requested hostname for HTTP and TLS. Traffic subject to address validation uses a different connection pool from traffic explicitly exempted from those checks.
With AllowPrivateNetworkAccess left false, hostname requests through a supplied HttpClient are rejected. Targets without support for bound connections also reject these requests. The tagged implementation documents both cases.
Built-in requests carrying validated addresses connect directly without a proxy. Deployments that require outbound proxies need specific testing.
Avoid treating a new exception as a reason to relax network policy automatically. Review why the application needs a custom transport and whether the built-in client can meet that need before changing access settings.
File integrations have breaking changes
Microsoft also marks its file-access consolidation as breaking. Shared components replace separate handling across several plugins, including document operations, cloud-drive uploads and local downloads.
One concrete change affects the .NET Python Sessions plugin. Its settings documentation says saving a download to disk requires a nonempty AllowedDownloadDirectories list. A download that returns bytes without a local path remains allowed by that setting.
Custom connectors also need attention. The filesystem interface requires directory restrictions to be enforced while opening a file. Its update operation returns a stream and whether that operation created the file, rather than relying on a separate existence check.
The cloud-drive interface now takes a stream for small-file uploads, documented as under 4MB. It must be readable, seekable and positioned at the upload’s start. The caller keeps it open until completion.
What to test before upgrading
ByteForward has not independently tested this release. Start with the features the application actually exposes. Exercise authorized database writes and rejected out-of-scope targets, HTTP calls through custom clients, downloads with and without a disk destination, and any custom file connectors.
These are integration checks, not evidence that every Semantic Kernel application is affected equally. An application using model calls without these plugins has a different review scope from an agent allowed to modify records or handle local files.
For affected teams, 1.82.0 makes application responsibilities more explicit. A successful package restore should be followed by tests of the tool actions users depend on, especially where existing code relied on convenience defaults.
Featured image: AI generated editorial illustration. Microsoft logo used with permission from Microsoft.
