fix: honor Kiota request extensions in Graph transport by rksharma-owg · Pull Request #1129 · microsoftgraph/msgraph-sdk-python-core

RKS (rksharma-owg) · 2026-09-22T02:53:26Z

Overview

Restore Graph middleware execution for requests built by microsoft-kiota-http 1.13.0. Graph-core 1.5.1 only enters its middleware pipeline when an HTTPX request has the legacy .options attribute. Kiota commit d9180bb moved per-request options to request.extensions["kiota_request_options"], so the Graph transport bypasses redirect, URL replacement, retry, and telemetry middleware. For an empty 302 response from DriveItem /content, this makes the binary request return None instead of following the download URL.

Accept the extension-based options while retaining support for the legacy attribute used by earlier Kiota releases. Graph request context now receives the extension options when present. When the extension is absent, legacy options are mirrored into it before sending so Kiota 1.13 middleware honors nondefault options. An explicit extension mapping, including an empty mapping, takes precedence. Raise the Kiota dependency minimums and development pins to 1.13.0 so installed components stay aligned. Legacy request-option handling remains supported; no generated SDK changes are needed.

Fixes #1128. Related: microsoft/kiota-python#745 and microsoft/kiota-python#744.

Notes

A credential-free HTTPX transport reproduction returned None after one 302 with Kiota HTTP 1.13.0, but followed the redirect and returned bytes with 1.12.3. The new integration test failed on the unmodified Graph-core transport and passes with this change. It covers two binary content types, legacy option compatibility, extension precedence, and requests without options.

The full-tree isort --check-only src reports an unchanged import-order issue in batch_request_item.py; the repository's actual CI command, isort src, succeeds and only reorders that existing file in an isolated checkout. No unrelated formatting is included here.

Testing Instructions

pytest with the updated development requirements (Kiota 1.13.0, HTTPX 0.28.1): 84 tests passed locally on Python 3.13.14.
A real redirect-middleware regression verifies that legacy should_redirect=False stops at the first 302. It fails before the bridge and passes afterward, with controls for extension precedence, explicit empty extension options, and empty legacy options.
The direct extension-only transport regression fails on the original transport because Graph request context is absent and passes with the corrected transport. It exercises the real middleware pipeline without the legacy request attribute, including an empty options mapping.
yapf -dr src, changed-file isort --check-only, mypy src, pylint src --disable=W --rcfile=.pylintrc, and sdist/wheel build passed locally.
Fork preflight verified contribution SHA 156d94701fad9b30b21b534a853b979c1b3d3d25 against upstream base ec79992519f708a014676584d5626ea8d733fe2c. Python 3.10–3.14 each passed 84 tests, formatting, changed-file import checks, types, lint, dependency consistency, and package builds. CodeQL also passed. The same matrix and CodeQL also passed for isolated merge validation at f96d4f54cd24516c0bea58069a94a4af1276e8a6.

Upstream PR checks are evaluated separately from the completed fork validation.

Mrfence97 · 2026-09-25T09:08:00Z

Hi team, is there an update on getting this reviewed? And is there a plan to issue a hotfix release once it's done?

RKS (rksharma-owg) · 2026-09-25T14:31:24Z

Thanks for checking in. The fix is ready for review, and the checks currently reported on this PR are passing. I don't have an estimate for maintainer review or a hotfix release; the maintainers will decide the release timing after reviewing the change.

…K placeholder (#81) * fix(deps): cap kiota below 1.13 — /me was reaching the wire as the SDK placeholder A fresh `uv tool install outlook-graph-mcp` resolved microsoft-kiota-* 1.13+ and every /me call failed with "me-token-to-replace is invalid" (#80). kiota 1.13.0 (2026-09-18) moved per-request options from a monkey-patched `request.options` attribute to `request.extensions["kiota_request_options"]`, and its UrlReplaceHandler now reads only the new place. msgraph-core 1.5.1, the latest release, still reads `request.options` in middleware/async_graph_transport.py, so the rewrite it installs for `/users/me-token-to-replace` -> `/me` never fires and Graph receives the literal placeholder. The upstream fix is microsoftgraph/msgraph-sdk-python-core#1129, open and unreleased. Nothing capped kiota; msgraph-core itself allows <2.0. The lock pinned 1.12.3, so `uv sync`, every CI job and every developer install were green while every new user's install was broken — the fresh-install and published-install canaries imported the package, counted the tools and never sent a request. Same class as the five-week outage. The kiota family is capped below 1.13 until a msgraph-core release carries #1129; the lock is unchanged at 1.12.3. tests/test_me_rewrite_reaches_the_wire.py builds the client exactly as msgraph does, hands the factory an httpx client on a mock transport, and asserts on the URL the real middleware pipeline sends. It runs against whatever the environment resolved, which is the point. Verified by mutation: under the lock it passes; against kiota 1.14.0 it fails on `.../users/me-token-to-replace`. Both install jobs in ci.yml now run it as a script after their version report. Note the published-install job installs PyPI-latest, which IS broken, so that weekly job will be red until the next release ships — that is the canary doing its job. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LparmojWQ3m9tcJhRGqZjP * test(wire): the nested /me path is rewritten too, and says why Graph tolerates /users/<anything> one segment deep, so a bare /me health check returns 200 with the placeholder still in the URL while every nested path 404s. A canary that probed Graph with /me alone would stay green (Nyaecho, #80). Asserting on the URL string catches both; the nested case carries the explanation. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LparmojWQ3m9tcJhRGqZjP --------- Co-authored-by: Michael Palermiti <253352132+mpalermiti@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>

…K placeholder (#81) * fix(deps): cap kiota below 1.13 — /me was reaching the wire as the SDK placeholder A fresh `uv tool install outlook-graph-mcp` resolved microsoft-kiota-* 1.13+ and every /me call failed with "me-token-to-replace is invalid" (#80). kiota 1.13.0 (2026-09-18) moved per-request options from a monkey-patched `request.options` attribute to `request.extensions["kiota_request_options"]`, and its UrlReplaceHandler now reads only the new place. msgraph-core 1.5.1, the latest release, still reads `request.options` in middleware/async_graph_transport.py, so the rewrite it installs for `/users/me-token-to-replace` -> `/me` never fires and Graph receives the literal placeholder. The upstream fix is microsoftgraph/msgraph-sdk-python-core#1129, open and unreleased. Nothing capped kiota; msgraph-core itself allows <2.0. The lock pinned 1.12.3, so `uv sync`, every CI job and every developer install were green while every new user's install was broken — the fresh-install and published-install canaries imported the package, counted the tools and never sent a request. Same class as the five-week outage. The kiota family is capped below 1.13 until a msgraph-core release carries #1129; the lock is unchanged at 1.12.3. tests/test_me_rewrite_reaches_the_wire.py builds the client exactly as msgraph does, hands the factory an httpx client on a mock transport, and asserts on the URL the real middleware pipeline sends. It runs against whatever the environment resolved, which is the point. Verified by mutation: under the lock it passes; against kiota 1.14.0 it fails on `.../users/me-token-to-replace`. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LparmojWQ3m9tcJhRGqZjP * test(wire): the nested /me path is rewritten too, and says why Graph tolerates /users/<anything> one segment deep, so a bare /me health check returns 200 with the placeholder still in the URL while every nested path 404s. A canary that probed Graph with /me alone would stay green (Nyaecho, #80). Asserting on the URL string catches both; the nested case carries the explanation. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LparmojWQ3m9tcJhRGqZjP (cherry picked from commit d16bd30 onto v1.22.0 for the 1.22.1 hotfix; CHANGELOG entry rewritten as a 1.22.1 section. The ci.yml step that runs this test in the install jobs is not part of #81 as merged and is not included here.) --------- Co-authored-by: Michael Palermiti <253352132+mpalermiti@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>

Copilot

Copilot review overview

🟡 Changes recommended

The normal CI suite lacks a direct extension-only regression test for the corrected pipeline gate.

Review effort: Balanced
Findings: 1

Open (1)

Add regression test for extension-only request pipeline handling · New

What changed in this PR

Restores Graph middleware for Kiota requests using HTTPX extensions while preserving legacy option support.

Changes:

Recognizes kiota_request_options extensions and gives them precedence.
Adds redirect, compatibility, and no-options tests.

File	Description
`src/msgraph_core/middleware/async_graph_transport.py`	Supports extension-based request options.
`tests/middleware/test_async_graph_transport.py`	Tests redirects and option handling.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Copilot review overview

🟡 Changes recommended

Legacy options enter the pipeline but are not propagated where Kiota 1.13 middleware can read them.

Review effort: Balanced
Findings: 1

Open (1)

Legacy options are not propagated to Kiota middleware extensions · New

Resolved since last review (1)

Add regression test for extension-only request pipeline handling

sonarqubecloud · 2026-10-06T16:49:19Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

fix: honor Kiota request extensions in Graph transport

b8d5927

RKS (rksharma-owg) requested a review from a team as a code owner September 22, 2026 02:53

This was referenced Sep 25, 2026

me-token-to-replace is invalid on fresh install — microsoft-kiota >=1.13.0 breaks /me calls mpalermiti/outlook-mcp#80

Closed

fix(deps): cap kiota below 1.13 — /me was reaching the wire as the SDK placeholder mpalermiti/outlook-mcp#81

Merged

David Blain (dabla) mentioned this pull request Oct 2, 2026

Cap microsoft-kiota-http below 1.13 in the Microsoft Azure provider apache/airflow#74090

Merged

1 task done

Vincent Biret (baywet) requested a balanced review from Copilot October 5, 2026 12:49

Copilot started reviewing on behalf of Vincent Biret (baywet) October 5, 2026 12:50 View session

Copilot AI reviewed Oct 5, 2026

View reviewed changes

Comment thread tests/middleware/test_async_graph_transport.py

Vincent Biret (baywet) reviewed Oct 5, 2026

View reviewed changes

Comment thread src/msgraph_core/middleware/async_graph_transport.py

Henrique Andrade (thehcma) mentioned this pull request Oct 5, 2026

Dependabot widens blumkin's acknowledged microsoft-kiota-http cap (blumkin#425); dep-updater is correct, Dependabot needs an ignore the-hcma/repository-helpers#699

Closed

fix: align Kiota minimum versions and test extension-only transport

e78dcaf

Vincent Biret (baywet) requested a balanced review from Copilot October 6, 2026 11:06

Copilot started reviewing on behalf of Vincent Biret (baywet) October 6, 2026 11:07 View session

Copilot AI reviewed Oct 6, 2026

View reviewed changes

Comment thread src/msgraph_core/middleware/async_graph_transport.py Outdated

fix: propagate legacy request options to Kiota middleware

156d947

Navigation Menu

fix: honor Kiota request extensions in Graph transport - #1129

fix: honor Kiota request extensions in Graph transport#1129
RKS (rksharma-owg) wants to merge 3 commits into
microsoftgraph:mainfrom
rksharma-owg:codex/graph-kiota-request-options

RKS (rksharma-owg) commented Sep 22, 2026 •

edited

Loading

Uh oh!

Mrfence97 commented Sep 25, 2026

Uh oh!

RKS (rksharma-owg) commented Sep 25, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

sonarqubecloud Bot commented Oct 6, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

RKS (rksharma-owg) commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

Notes

Testing Instructions

Uh oh!

Mrfence97 commented Sep 25, 2026

Uh oh!

RKS (rksharma-owg) commented Sep 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

sonarqubecloud Bot commented Oct 6, 2026

Quality Gate passed

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

RKS (rksharma-owg) commented Sep 22, 2026 •

edited

Loading