Python: [Breaking] Update OpenAPI document parsing options

[SergeyMenshykh]

Update OpenAPI document parsing to gate file and HTTP ref resolution separately.

Breaking change

• RESOLVE_FILES is no longer enabled by default. Only internal JSON pointer references are resolved by default.
• Users with multi-file OpenAPI specs must now pass enable_file_ref_resolution=True via OpenAPIFunctionExecutionParameters.
• enable_external_ref_resolution has been renamed to enable_http_ref_resolution.

[moonbox3]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
connectors/openapi_plugin
openapi_function_execution_parameters.py	29	0	100%
openapi_manager.py	79	8	89%	53, 74, 96–99, 144–145
openapi_parser.py	133	8	93%	82, 139, 203, 260, 274–275, 278–279
TOTAL	28655	5638	80%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
3932	23 💤	0 ❌	0 🔥	1m 58s ⏱️

[github-actions]

Automated Code Review

Reviewers: 4 | Confidence: 88% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Design Approach

---

Automated review by SergeyMenshykh's agents

[Copilot]

Pull request overview

This PR updates Python OpenAPI parsing to make external HTTP $ref resolution opt-in via execution settings, while adding tests around the new default behavior.

Changes:

• Added enable_external_ref_resolution to OpenAPI execution parameters.
• Passed the new option through OpenAPI plugin creation into OpenApiParser.parse.
• Added parser tests for default HTTP ref blocking and internal ref resolution.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
python/semantic_kernel/connectors/openapi_plugin/openapi_parser.py	Adds resolver type selection for OpenAPI $ref handling.
python/semantic_kernel/connectors/openapi_plugin/openapi_manager.py	Propagates execution settings into parser options.
python/semantic_kernel/connectors/openapi_plugin/openapi_function_execution_parameters.py	Adds the new external ref resolution setting.
python/tests/unit/connectors/openapi_plugin/test_openapi_parser.py	Adds coverage for HTTP and internal $ref parsing behavior.
python/tests/unit/connectors/openapi_plugin/test_openapi_manager.py	Updates parser mock expectation for the new argument.

Comments suppressed due to low confidence (1)

python/semantic_kernel/connectors/openapi_plugin/openapi_parser.py:60

• This only changes which refs prance resolves; it does not explicitly detect and reject HTTP/HTTPS $refs. Depending on the validator backend, those refs can be left unresolved in the parsed spec or still be fetched during validation, so the default does not reliably enforce the intended "block external HTTP refs" behavior. Add an explicit pre-validation check or a resolver/handler that fails closed for HTTP refs when the option is disabled.

        resolve_types = RESOLVE_INTERNAL | RESOLVE_FILES
        if enable_external_ref_resolution:
            resolve_types |= RESOLVE_HTTP
        parser = ResolvingParser(openapi_document, resolve_types=resolve_types)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Automated Code Review

Reviewers: 4 | Confidence: 94% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Design Approach

---

Automated review by SergeyMenshykh's agents