[Rick Brighenti (rbrighenti)]

Prepares the per-package CHANGELOGs for the 2.0.0 release (2026-10-20). Changelog files only.

• [Unreleased] -> [2.0.0] - 2026-10-20 across libraries, covering user-facing changes since v1.0.0 (Breaking/Added/Changed/Fixed/Security/Migration).
• observability-core: merged duplicate Breaking sections; added ApplyGuardrailScope (Add ApplyGuardrailScope for security guardrail evaluation tracing #259), plain-array message serialization (Align message serialization to OTel spec: remove version wrapper #256, breaking), NonRecordingSpan fix (fix: use get_span_context() to handle NonRecordingSpan #258), Add model observation telemetry attributes #282 additions.
• hosting: productContext sub-channel fallback (fix: add product context fallback for subchanne; #252), new direct runtime dependency.
• langchain/openai/semantickernel extensions: model/token attribute changes, langchain meta-package removal (fix langchain security issue #268), security floors (fix(deps): upgrade dependencies to address security vulnerabilities #276).
• tooling: PyJWT floor; fixed misplaced Added bullets.
• New CHANGELOGs: notifications (Add Python SDK support for new lifecycle event types #206) and the four tooling extensions.
• Content already shipped at the v1.0.0 tag moved under [1.0.0] - 2026-05-01; observability-core's unpublished [0.3.0] relabeled as 1.0.0.

Review notes:

• 1.0.0 date uses the PyPI upload date (2026-05-01); the tag commit is 2026-04-30.
• AgentLifecycleEvent.USERDELETED value change listed as Breaking in notifications; please confirm.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

🟡 Changes recommended

Constructor guidance incorrectly implies that callers can omit the required model argument.

1 open issue

• Nullable model field lacks default for response-only calls · New

What changed in this PR

Prepares package changelogs for the 2.0.0 release without changing runtime code.

Changes:

• Dates release sections and separates previously shipped 1.0.0 content.
• Documents breaking changes, telemetry improvements, fixes, and security dependency floors.
• Adds changelogs for notifications and four tooling extensions.

File	Description
libraries/​microsoft-agents-a365-tooling/​CHANGELOG.md	Records PyJWT floor and reorganizes historical additions.
libraries/​microsoft-agents-a365-tooling-extensions-semantickernel/​CHANGELOG.md	Adds security release notes.
libraries/​microsoft-agents-a365-tooling-extensions-openai/​CHANGELOG.md	Adds security release notes.
libraries/​microsoft-agents-a365-tooling-extensions-googleadk/​CHANGELOG.md	Documents Google ADK and dependency security floors.
libraries/​microsoft-agents-a365-tooling-extensions-agentframework/​CHANGELOG.md	Adds security release notes.
libraries/​microsoft-agents-a365-runtime/​CHANGELOG.md	Dates the 2.0.0 release section.
libraries/​microsoft-agents-a365-observability-hosting/​CHANGELOG.md	Documents sub-channel fallback and runtime dependency.
libraries/​microsoft-agents-a365-observability-extensions-semantickernel/​CHANGELOG.md	Separates security updates from historical changes.
libraries/​microsoft-agents-a365-observability-extensions-openai/​CHANGELOG.md	Documents model attributes, cache tokens, and security floors.
libraries/​microsoft-agents-a365-observability-extensions-langchain/​CHANGELOG.md	Documents dependency removal and security floors.
libraries/​microsoft-agents-a365-observability-core/​CHANGELOG.md	Consolidates breaking changes, telemetry additions, and migration guidance.
libraries/​microsoft-agents-a365-notifications/​CHANGELOG.md	Adds lifecycle-event changes and PyJWT security notes.

_{Review effort: Balanced}