v0.51.1 - September 8, 2026

Bug Fixes

• cryptography raised to >=48.0.1,<51: fixes HIGH vulnerability GHSA-537c-gmf6-5ccf present in all versions below 48.
• protovalidate upgraded to >=1.0.0,<2: resolves a startup crash (AttributeError: FieldDescriptor has no attribute 'label') caused by protovalidate 0.x being incompatible with protobuf 6. protobuf lower bound also raised to >=6.33.5.
• OpenTelemetry upgraded to 1.44.0: opentelemetry-api, opentelemetry-sdk, exporters, and instrumentation packages bumped from 1.43.x/0.64b0 to 1.44.x/0.65b0, unblocking consumers already on 1.44.

v0.51.0 - September 4, 2026

What's New

• Identity attributes on log records: OTel log records now automatically carry sap.tenancy.tenant_id and user.id, matching the attributes already present on traces. The new IdentityLogFilter is installed on the LoggingHandler as part of setup_log_provider() / auto_instrument().

  Resolution priority for both attributes:

  1. Runtime context populated by bootstrap() (GLOBAL_TENANT_ID, USER_ID from IASContextProvider)
  2. IAS auth context set by StarletteIASTelemetryMiddleware (sap_gtid, user_uuid claims)
  3. Omitted when no identity is available (e.g. log lines emitted at startup)

  Contributors

  • @LucasAlvesSoares

v0.50.0 - September 04, 2026

What's New

• Agent Memory multitenancy: AgentMemoryClient now supports Agent Memory multi-tenancy via a reusable XSUAA service. This means a single "default" service binding is now required for all access strategies. The subscriber tenant subdomain is forwarded as tenant_subdomain to every HTTP transport operation. The subscriber token URL is derived from the provider binding's URL, replacing the identityzone field with the subscriber tenant subdomain, following a standard XSUAA integration. No per-tenant service instances, bindings, or secret mounts are required.
• Subscriber tenant environment variable: Added CLOUD_SDK_CFG_HANA_AGENT_MEMORY_DEFAULT_SUBSCRIBER_TENANT to configure the subscriber tenant for integration tests and local development. Multi-tenant test scenarios are automatically skipped when this variable is absent.

Improvements

• Tenant validation: AgentMemoryClient.__init__ now calls _validate_tenant_subdomain at construction time for SUBSCRIBER access strategy, surfacing invalid subdomain values immediately.

Contributors

• @cassiofariasmachado

v0.49.2 - September 4, 2026

Improvements

• Dependency version constraints: All runtime and optional dependencies now carry explicit upper-bound version caps (>=X,<Y) to prevent silent breakage when upstream packages release incompatible major versions. Previously, many dependencies used unbounded >= specifiers. The following packages were updated:
  • requests: >=2.33.0,<3
  • requests-oauthlib: >=2.0.0,<3
  • setuptools: >=83.0,<84
  • minio: >=7.2.16,<7.2.17
  • httpx: >=0.27.0,<1
  • PyJWT: >=2.13.0,<3
  • protobuf: >=6.0.0,<7 (minimum also raised from 5.29.5)
  • protovalidate: >=0.14.1,<1
  • grpcio: >=1.60.0,<2
  • opentelemetry-api: >=1.43.0,<2
  • opentelemetry-sdk: >=1.43.0,<2
  • opentelemetry-instrumentation-langchain: >=0.61.0,<1
  • mcp: >=1.1.0,<2
  • cryptography: >=46.0.3,<47
  • Optional extras: a2a-sdk<2, starlette<1, fastapi<1, aiohttp<4, sqlalchemy<3, django<5, flask<4, langgraph<2

Bug Fixes

• data_anonymization._http_transport: Fixed a ty type-checker error in HttpTransport._post_file_request. The file_value variable is now explicitly typed as BinaryIO | bytes and an assertion guards the else branch to narrow request.file_content away from None, satisfying the requests.Session.post files parameter type contract.

Contributors

v0.36.1 - Sep 04, 2025

Bug Fixes

• Dependency pinning: Added upper-bound version constraints (<N) to all runtime and dev dependencies in pyproject.toml to prevent unexpected breakage from future major-version releases. Affected packages include requests, httpx, PyJWT, protobuf, grpcio, mcp, opentelemetry-api, opentelemetry-sdk, opentelemetry-instrumentation-langchain, protovalidate, a2a-sdk, starlette, langchain-core, langgraph, and all dev-only packages.
• protobuf lower bound raised: Bumped minimum protobuf version from >=4.25.0 to >=5.0.0 to align with the a2a-sdk compatibility requirement.
• S3Error constructor fix: Updated unit tests in tests/objectstore/unit/test_s3_client.py to match the updated S3Error constructor argument order in the pinned minio~=7.2.16 release (response object moved to first positional argument).
• A2A Message schema fix: Updated unit tests in tests/extensibility/unit/test_client.py to reflect the upstream a2a-sdk API change where Message.role changed from an integer (2) to a string ("agent") and parts became a required field.

Contributors

• @ArthurTonial

v0.49.1 - September 3, 2026

What's New

• joule_studio_gsid in extension telemetry: extension_context() now accepts a joule_studio_gsid parameter alongside solution_id. When provided, it is propagated via OTel baggage, stamped as a span attribute (sap.extension.joule_studio_gsid), and available to the ExtensionContextLogFilter.

  from sap_cloud_sdk.core.telemetry import extension_context
  
  with extension_context(
      capability_id="default",
      extension_name="MyExtension",
      joule_studio_gsid="gsid-abc123",
  ):
      result = await mcp_client.call_tool("my_tool", args)

Contributors

• Rishi Kunnath (@rishikunnath2747)

v0.49.0 - September 02, 2026

New Features

• Transparent proxy routing mode (AICORE_PROXY_URL): routes all LiteLLM calls through an external proxy via litellm.api_base. Agent code is identical in all environments — the deployer controls routing by injecting the appropriate env var. No AI Core credentials are written to the process environment.

• BTP Destination Service mode (AICORE_DESTINATION_NAME): loads AI Core credentials from a named BTP Destination at startup. The deployer only needs to inject Destination Service binding credentials; the AI Core client_secret never needs to be in the K8s Secret directly.

• patch_litellm_for_credential_rotation(): patches litellm.completion / litellm.acompletion globally so LangGraph / ChatLiteLLM agents get the same transparent 401-reload behaviour as the SDK's own completion() wrappers.

• All three routing modes (proxy, destination, direct) are detected automatically by set_aicore_config() — no code changes required in agent logic.

Contributors

• Application Foundation Toolkit Libraries Team

v0.48.2 - September 01, 2026

Bug Fixes

• mcp 2.0.0 renamed result-object fields from camelCase to snake_case (serverInfo → server_info, inputSchema → input_schema, isError → is_error). The agentgateway module read the old names directly, causing a silent AttributeError in the LoB tool-discovery path that left agents with an empty tool list. Three version-agnostic helpers now read whichever field name is present.

Contributors

• Application Foundation Toolkit Libraries Team

v0.48.1 - September 01, 2026

Bug Fixes

• agentgateway: Fixed ImportError when importing sap_cloud_sdk.agentgateway with mcp versions that renamed McpError to MCPError. A try/except ImportError fallback is now used in _customer.py and _lob.py so the module loads correctly regardless of which name the installed mcp version exports.

Contributors

• @cassiofariasmachado

v0.48.0 - August 24, 2026

What's New

• Instrumentation introspection: Two new functions let modules and users query the SDK's instrumentation state at runtime, using typed StrEnum members for autocomplete and refactor safety.

  • get_attached_adapters() -> list[Adapter]: Returns the framework adapters attached via bootstrap(app). Returns an empty list if bootstrap() has not been called yet.

    from sap_cloud_sdk.core.runtime_context import Adapter, get_attached_adapters
    
    if Adapter.STARLETTE not in get_attached_adapters():
        raise RuntimeError("bootstrap(app) must be called before using this client.")

  • get_instrumented_libraries() -> list[Library]: Returns the libraries successfully patched by auto_instrument(). Only libraries that are installed and actually instrumented appear. Skipped libraries (not installed) are not included.

    from sap_cloud_sdk.core.telemetry import Library, get_instrumented_libraries
    
    if Library.HTTPX in get_instrumented_libraries():
        ...

• Adapter enum: Exported from sap_cloud_sdk.core.runtime_context. Currently defines Adapter.STARLETTE. Used as the return type of get_attached_adapters() and as the name property on FrameworkAdapter subclasses.

• Library enum: Exported from sap_cloud_sdk.core.telemetry. Defines members for all built-in instrumented libraries: AIOHTTP, DJANGO, FASTAPI, FLASK, GRPC, HTTPX, LOGGING, REQUESTS, SQLALCHEMY, STARLETTE. Used as the return type of get_instrumented_libraries() and as the library_name attribute on LibraryInstrumentor subclasses.

Contributors

• Lucas Soares (@lucassoares)