Agent Framework stops forwarding headers across redirects and revalidates file skill paths before use
GitHub·low signal
Two quieter fixes in dotnet-1.21.0 address credential and path handling: #8164 stops the HTTP stack forwarding headers on a redirect, the classic route for leaking an Authorization header to a third-party host, and #8151 revalidates file skill paths immediately before use rather than trusting an earlier check. #8146 additionally scopes OpenAI hosting storage by isolation key. All three sit unlabeled in a 37-PR changelog alongside dependency bumps, so they are easy to miss on a skim.