Native Python App Service fails to start when AnyIO imports typing_extensions.sentinel

[Xeelee33]

Summary

A native Python deployment of application/single_app to an Azure App Service deployment slot fails during Gunicorn worker startup.

The application never reaches Flask initialization because the Semantic Kernel MCP dependency chain raises an ImportError while importing AnyIO.

Environment

• Azure App Service on Linux

• Native Python runtime

• Python 3.12.13

• Oryx build

• Gunicorn 25.0.3

• Startup command:

  python -m gunicorn -c gunicorn.conf.py app:app
  

• Deployment unit: application/single_app

• Affected application version: 0.261.030

Error

ImportError: cannot import name 'sentinel' from 'typing_extensions'
(/agents/python/typing_extensions.py)

The relevant import chain is:

app.py
  -> semantic_kernel_loader.py
  -> semantic_kernel_plugins/logged_plugin_loader.py
  -> semantic_kernel_plugins/mcp_plugin_factory.py
  -> semantic_kernel.connectors.mcp
  -> mcp.client.session
  -> anyio.streams.memory
  -> anyio._core._typedattr
  -> typing_extensions.sentinel

Both Gunicorn workers fail during startup and exit before the application can serve requests.

Root Cause

Oryx prepends the App Service platform agent directory to PYTHONPATH:

/agents/python:/opt/startup/app_logs:<application virtual environment>

As a result, /agents/python/typing_extensions.py shadows the newer typing-extensions package installed in the application's virtual environment.

The application's dependency set did not constrain AnyIO. It could therefore resolve AnyIO 4.11 or later, which imports sentinel from typing_extensions. The older App Service platform copy does not provide that symbol.

This creates an incompatibility between:

• AnyIO 4.11 or later
• The older typing_extensions module injected by the App Service platform agent
• The Semantic Kernel to MCP startup import path

Proposed Fix

Pin AnyIO to version 4.10.0 in:

application/single_app/requirements.txt

anyio==4.10.0

AnyIO 4.10.0 is the latest release before the typing_extensions.sentinel import was introduced. It remains compatible with the dependency ranges declared by Semantic Kernel 1.39.4 and MCP.

The deployment must perform a fresh Oryx dependency build after applying the pin so the previous AnyIO installation is not reused.

Validation Performed

• Confirmed AnyIO 4.11.0 imports sentinel from typing_extensions.
• Confirmed AnyIO 4.10.0 does not import that symbol.
• Confirmed anyio.streams.memory from AnyIO 4.10.0 imports successfully with typing-extensions 4.11.0.
• Confirmed pip can resolve:
  • semantic-kernel==1.39.4
  • mcp==1.30.0
  • anyio==4.10.0
  • typing-extensions==4.16.0

Acceptance Criteria

• Native Python App Service deployments complete Gunicorn worker initialization.
• Semantic Kernel and MCP modules import successfully when the App Service agent directory precedes the application environment on PYTHONPATH.
• requirements.txt explicitly constrains AnyIO to the compatible release.
• Regression coverage verifies the compatibility constraint.
• A fresh deployment slot build starts and responds successfully.

Impact

This blocks startup for affected native Python App Service deployments. Container-based deployments are not expected to be affected because they use the dependencies and import paths contained in the repository image.

[Bionic711]

There were some issues with compatibility between 1.40+ or SK and other modules we use. We need to verify whether or not those have been resolved and attempt to update to SK 1.44.1 is possible as a primary strategy which may or may not also resolve this issue.