v2.0.16

This patch release fixes targeted messaging in 1:1 user chats.

Changes

Messaging

• Allow targeted messages in personal (1:1) chats. The SDK previously rejected this supported flow before sending the request (#797) by Aamir Jawaid (@heyitsaamir).

Install

npm install @microsoft/teams.apps@latest

v2.0.15

This maintenance release improves authentication configuration, Teams messaging and invoke support, activity handling, and SDK reliability while keeping the stable 2.0 API line. It contains eligible changes after v2.0.14 through the pre-Agent-365 cutoff; Agent 365 and other 2.1-only work are intentionally excluded.

Highlights

• Adds experimental HTML widgets for MCP Apps UI and improves the example rendering (#626, #678) by Corina (@corinagum).
• Adds typed application/search invoke support for Adaptive Card dynamic typeahead (#667) by Corina (@corinagum).
• Sends OAuth/SSO sign-in cards directly in group chats and channels using targeted messages (#676) by Lily Du (@lilyydu).
• Replaces the ambiguous skipAuth option with dangerouslyAllowUnauthenticatedRequests, while retaining skipAuth as a deprecated compatibility alias (#636) by Aamir Jawaid (@heyitsaamir).

Changes

Activities, messaging, and authentication

• Add optional app metadata to ChannelData (#644) by Mehak Bindra (@MehakBindra).
• Preserve live activity instances so channel, team, meeting, notification, and tenant accessors resolve correctly (#647) by Corina (@corinagum).
• Add oauth.fetchUserToken control and skip eager per-activity token lookup when OAuth is not configured (#653) by Corina (@corinagum).
• Align reply POST requests with the base activities endpoint while preserving replyToId semantics (#665) by Corina (@corinagum).
• Add teamMemberAdded and teamMemberRemoved to the typed conversation update event union (#666) by Corina (@corinagum).

Tooling, tests, and documentation

• Prune unused dependencies and add knip checks to CI (#554) by Aamir Jawaid (@heyitsaamir).
• Port CI fixes and prepare the 2.0.15 release line (#650) by Lily Du (@lilyydu).
• Align integration-test environment variable names across SDKs (#651) by Corina (@corinagum).
• Document that extendedmarkdown remains in public preview (#659) by Kavin (@singhk97).

Dependency updates

• Update Axios (#660), form-data (#661), body-parser (#663), shell-quote/concurrently (#664), @hono/node-server (#669), Hono (#670), fast-uri (#671), React Router (#672, #674), and PostCSS (#673) via Dependabot (@dependabot).

Install

npm install @microsoft/teams.apps@latest

v2.1.0-preview.3

The first 2.1 preview introduces Agent 365 support across agentic identity, lifecycle events, proactive messaging, and OpenTelemetry-based observability. It also includes the stable 2.0.15 maintenance set; those shared changes are not repeated below.

Prerelease: This build is published under the npm next tag for evaluation and may change before the stable 2.1 release.

Highlights

• Adds the integrated Agent 365/ACF feature set, including agentic identity scoping, lifecycle routing, proactive send helpers, token acquisition, and observability (#627) by Aamir Jawaid (@heyitsaamir).
• Adds SDK-level OpenTelemetry spans and metrics for inbound activity processing, handler dispatch, outbound Teams API calls, and authentication (#655, #656) by Aamir Jawaid (@heyitsaamir).
• Aligns final streaming messages with the Teams contract by omitting streamSequence from the final request (#688) by maelga.

Changes

Agentic identity and messaging

• Add AgenticIdentity request scoping and service URL overrides to supported API operations (#631) by Aamir Jawaid (@heyitsaamir).
• Add agentic-aware app.send, reply, scoped client, and proactive-send helpers, with a runnable Agent 365 example (#632) by Aamir Jawaid (@heyitsaamir).
• Simplify API client scoping for agentic operations (#642) by Aamir Jawaid (@heyitsaamir).
• Add typed Agentic User lifecycle events and app routing aliases (#643) by Aamir Jawaid (@heyitsaamir).
• Align public SDK names with Agentic terminology while preserving service-owned wire values (#668) by Aamir Jawaid (@heyitsaamir).
• Use AgenticIdentity as the operation scope for proactive sends, scoped clients, and request baggage (#682) by Aamir Jawaid (@heyitsaamir).

Observability and token support

• Add common HTTP middleware plus outbound Teams API and authentication spans (#655) by Aamir Jawaid (@heyitsaamir).
• Add inbound activity and handler spans, metrics, and duration tracking (#656) by Aamir Jawaid (@heyitsaamir).
• Expose App.tokenProvider for named token capabilities required by Agent 365 telemetry exporters (#680) by Aamir Jawaid (@heyitsaamir).
• Add an opt-in Agent 365 OpenTelemetry baggage bridge for identity enrichment (#657) by Aamir Jawaid (@heyitsaamir).
• Update the Agent 365 example with Microsoft OpenTelemetry exporter setup, reactive turns, and proactive sends (#679) by Aamir Jawaid (@heyitsaamir).

Install

npm install @microsoft/teams.apps@next

v2.0.14

What's Changed

• chore(deps): bump react-router from 7.15.0 to 7.15.1 by @app/dependabot in #619
• chore: bump version to 2.0.14-preview and fix pipeline release job by Corina (@corinagum) in #620
• Remove ExperimentalTeamsQuotedReplies markers by Corina (@corinagum) in #621
• chore(deps): bump hono from 4.12.21 to 4.12.25 by @app/dependabot in #623
• test: add integration tests for Teams TypeScript SDK by Corina (@corinagum) in #622
• docs: update integration test runbook link to ADO wiki by Corina (@corinagum) in #624
• fix: use artifactName for pipelineArtifact inputs in publish pipeline by Corina (@corinagum) in #625
• Add extendedMarkdown text format value by Kavin (@singhk97) in #615
• refactor(apps): Move from file-based mixins to real classes by Aamir Jawaid (@heyitsaamir) in #633
• feat(api): flatten client method chains to reduce call hops by Lily Du (@lilyydu) in #634
• feat(apps): support resetting response streams and streaming error handling by Lily Du (@lilyydu) in #635
• chore(examples): migrate examples to the flattened conversation API by Lily Du (@lilyydu) in #637
• docs(contributing): note npm CFS proxy for Microsoft-managed devices by Corina (@corinagum) in #638
• set replyToId for all streaming activities by Lily Du (@lilyydu) in #646
• Split up Outbound and Inbound Activities by Aamir Jawaid (@heyitsaamir) in #639
• Deprecate skipAuth in favor of dangerouslyAllowUnauthenticatedRequests by Aamir Jawaid (@heyitsaamir) in #636
• Add App info to ChannelData by Mehak Bindra (@MehakBindra) in #644

Full Changelog: v2.0.13...v2.0.14

v2.0.13

What's Changed

Bug Fixes

• fix(client): use explicit Graph scopes for Teams Desktop NAA compatibility by Corina (@corinagum) in #616
• fix(api): conditionally set citation encodingFormat based on text presence by Chonlaphoom Thaiyanto (@chonlaphoom) in #579

Features & Improvements

• Replace BotBuilder plugin with HTTP adapter by Aamir Jawaid (@heyitsaamir) in #610
• Remove app manifest handling from teams.apps by Aamir Jawaid (@heyitsaamir) in #611
• Reject unauthenticated when no credentials by Aamir Jawaid (@heyitsaamir) in #506
• Merge root message entities in Activity by Aamir Jawaid (@heyitsaamir) in #590
• Cache federated identity MSAL clients by Aamir Jawaid (@heyitsaamir) in #613
• Bump MSAL Node to v5 by Aamir Jawaid (@heyitsaamir) in #603
• Improvements to the Teams MCP server example by Mehak Bindra (@MehakBindra) in #597

Documentation

• Refresh teams.apps README by Aamir Jawaid (@heyitsaamir) in #604

CI/Chores

• ci: switch publish pipeline to 1ES Official template for CodeQL/SDL by Corina (@corinagum) in #607
• ci: add weekly SDL pipeline for CodeQL/CredScan compliance by Corina (@corinagum) in #608
• ci: add merge_group trigger to Build & Test & Lint by Corina (@corinagum) in #602
• chore: prevent deprecated packages from being published by Corina (@corinagum) in #614
• Bump version to 2.0.13-preview; RELEASE.md adds tagging step by Corina (@corinagum) in #601

Dependencies

• chore(deps): bump react-router from 7.13.1 to 7.15.0 by Dependabot (@dependabot)[bot] in #605
• chore(deps): bump react-router from 7.15.0 to 7.15.1 by Dependabot (@dependabot)[bot] in #619
• chore(deps): bump hono from 4.12.18 to 4.12.21 by Dependabot (@dependabot)[bot] in #606
• chore(deps-dev): bump vite from 6.4.2 to 6.4.3 by Dependabot (@dependabot)[bot] in #617

Full Changelog: v2.0.12...v2.0.13

v2.0.12

Recent blog posts

• Quoted Replies and Threaded Replies in the Teams SDK

What's Changed

• Update quoted replies & new quotes features by Corina (@corinagum) in #482
• fix(apps): log inbound activities at info, warn on missing Authorization by Corina (@corinagum) in #568
• AI/MCPClient by Mehak Bindra (@MehakBindra) in #572
• Bump version to 2.0.12-preview; fix stray np in publish.yml by Corina (@corinagum) in #577
• Remove in-repo Teams CLI package by Aamir Jawaid (@heyitsaamir) in #580
• Sample: opt targeted-messages example into slash commands by Corina (@corinagum) in #583
• A2A Sample by Mehak Bindra (@MehakBindra) in #584
• Security: lock JsonWebToken trust-boundary contract by Corina (@corinagum) in #586
• Bump turbo from 2.8.11 to 2.9.14 by Dependabot (@dependabot) in #587
• Deprecate AI Libraries by Mehak Bindra (@MehakBindra) in #588
• TeamsSDK: Correct imports and return types in misc. packages by Jesperholmbergmsft in #589
• SuggestedActionSubmitActivity for suggestedAction/submit invoke by Shanmathi Mayuram Krithivasan (@ShanmathiMayuramKrithivasan) in #591
• Default targeted replies for targeted inbound messages by Aamir Jawaid (@heyitsaamir) in #592
• feat: deprecate DevtoolsPlugin in favor of Microsoft 365 Agents Playground by Corina (@corinagum) in #593
• Bump qs from 6.15.0 to 6.15.2 by Dependabot (@dependabot) in #594
• Security hardening: tighten cross-origin policies by Corina (@corinagum) in #595
• Filter colliding keys before Object.assign in ActivityContext by Corina (@corinagum) in #596
• fix(deps): Audit for release by Corina (@corinagum) in #599

Full Changelog: v2.0.11...v2.0.12

v2.0.11

What's Changed

• chore: bump version to 2.0.11-preview by Aamir Jawaid (@heyitsaamir) in #558
• ci: pin pipeline to Node 22 to match packageManager (npm 10) by Aamir Jawaid (@heyitsaamir) in #559
• Security hardening: MCP server auth by Corina (@corinagum) in #540
• Bump hono from 4.12.14 to 4.12.16 by Dependabot (@dependabot) in #562
• Update lock file by Rido (@rido-min) in #563
• Switch to named imports without subpaths by Jesperholmbergmsft in #561
• [Bug]: Cannot import @microsoft/teams.client into webpack 5 javascript react project: Module has no exports. by Jesperholmbergmsft in #566
• Rename ReactionClient.remove() to delete() by Corina (@corinagum) in #567
• Prompt Preview Support by Shanmathi Mayuram Krithivasan (@ShanmathiMayuramKrithivasan) in #536
• fix: Add null checks in local-memory.ts to prevent role crash by hggzm in #438
• Mark reactions API as GA and fix sample remove flow by Corina (@corinagum) in #575
• Fix App user-agent merging by Aamir Jawaid (@heyitsaamir) in #573

New Contributors

• hggzm made their first contribution in #438

Reverted / excluded from this release

• Quoted replies feature (#482) — reverted from this release; will be reintroduced in a future release.

Full Changelog: v2.0.10...v2.0.11

v2.0.10

What's Changed

• chore: bump version to 2.0.10-preview by Aamir Jawaid (@heyitsaamir) in #555
• MCP Server Example on MCP SDK by Mehak Bindra (@MehakBindra) in #534
• fix(http-stream): resolve race condition in close() and streamType override in final message by Chonlaphoom Thaiyanto (@chonlaphoom) in #553
• address model gaps by Lily Du (@lilyydu) in #525
• fix(apps): support AAD v1 issuers in token validation by Aamir Jawaid (@heyitsaamir) in #556
• Release 2.0.10 by Aamir Jawaid (@heyitsaamir) in #557
• hotfix: pin pipeline to Node 22 to unblock 2.0.10 release by Aamir Jawaid (@heyitsaamir) in #560

New Contributors

• Chonlaphoom Thaiyanto (@chonlaphoom) made their first contribution in #553

Full Changelog: v2.0.9...v2.0.10

v2.0.9

What's Changed

• Add proactive threading support by Corina (@corinagum) in #523
• Extract threading suffixes to constant by Corina (@corinagum) in #532
• feat: add action-based sub-route routing for dialogs and card actions by Aamir Jawaid (@heyitsaamir) in #529
• Remove supportsThreading guard from app.reply() by Corina (@corinagum) in #533
• Security hardening: token validation and service URL improvements by Corina (@corinagum) in #515
• feat: add custom feedback loop by Lily Du (@lilyydu) in #522
• python CLI - remove devtools and ai sample by Lily Du (@lilyydu) in #519
• chore(client): remove unused uuid dependency by Lily Du (@lilyydu) in #539
• fix: route app.graph + .ctx.graph to sovereign endpoints via cloud.graphScope by Corina (@corinagum) in #538
• Tighten additionalAllowedDomains API contract by Corina (@corinagum) in #541
• Revert serviceUrl allowlist (ADO 5310460) by Corina (@corinagum) in #545
• Security hardening: remove eval() from MCP plugin by Corina (@corinagum) in #537
• fix: address npm audit vulnerabilities by Aamir Jawaid (@heyitsaamir) in #546
• fix: regenerate lockfile to apply npm overrides by Aamir Jawaid (@heyitsaamir) in #550
• fix: make GraphError body/cause non-enumerable by Aamir Jawaid (@heyitsaamir) in #552

Full Changelog: v2.0.8...v2.0.9

v2.0.8

What's Changed

• Bump version to 2.0.8-preview by Aamir Jawaid (@heyitsaamir) in #502
• Bump hono from 4.12.9 to 4.12.12 by Dependabot (@dependabot)[bot] in #510
• Bump @hono/node-server from 1.19.11 to 1.19.13 by Dependabot (@dependabot)[bot] in #509
• Bump vite from 6.4.1 to 6.4.2 by Dependabot (@dependabot)[bot] in #514
• Bump axios from 1.13.5 to 1.15.0 by Dependabot (@dependabot)[bot] in #518
• feat: GitHub issue analysis → Teams notification workflow by Aamir Jawaid (@heyitsaamir) in #517
• Merge User-Agent headers when cloning HTTP client by Aamir Jawaid (@heyitsaamir) in #508
• feat: graceful stream cancellation on 403 by Aamir Jawaid (@heyitsaamir) in #513
• Add sovereign cloud support (GCCH, DoD, China) by Corina (@corinagum) in #500
• fix: drain entire queue per flush cycle by Aamir Jawaid (@heyitsaamir) in #520
• fix: resolve missing deps, broken JSON, type errors, and typos in CLI templates by Aamir Jawaid (@heyitsaamir) in #521
• feat: add missing endpoints (Paged Members, Meeting Notifs) & address client gaps by Lily Du (@lilyydu) in #516
• fix: surface Graph API error body in GraphError by Aamir Jawaid (@heyitsaamir) in #524
• fix: improve error message when app credentials are missing by Aamir Jawaid (@heyitsaamir) in #527
• Bump hono from 4.12.12 to 4.12.14 by Dependabot (@dependabot)[bot] in #528
• Bump version to 2.0.9-preview by Aamir Jawaid (@heyitsaamir) in #531

Full Changelog: v2.0.7...v2.0.8