deps: Bump GitHub.Copilot.SDK from 1.0.3 to 1.0.7 by dependabot[bot] · Pull Request #1508 · bradygaster/squad

dependabot · 2026-07-20T08:17:47Z

Updated GitHub.Copilot.SDK from 1.0.3 to 1.0.7.

Release notes

Sourced from GitHub.Copilot.SDK's releases.

1.0.7

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.7</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.7")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.7'

Feature: opaque metadata passthrough for tool definitions

Hosts can now attach namespaced, opaque metadata to tool definitions and have it forwarded verbatim over the session.create/resumeSession wire call. Use ToolDefinition.createWithMetadata(...) or the fluent .metadata(Map) builder, or express shallow flag maps via @CopilotTool.MetadataEntry annotations. (#1864)

ToolDefinition tool = ToolDefinition.create("search", "Search files", schema, handler)
    .metadata(Map.of("com.example:featureFlags", Map.of("streamResults", true)));

Feature: tool search configuration support

SessionConfig and ResumeSessionConfig now accept a ToolSearchConfig that enables server-side tool search and controls the deferral threshold. Tool results can also carry back toolReferences indicating which tools were consulted during search. (#1933)

SessionConfig config = new SessionConfig()
    .setToolSearch(new ToolSearchConfig().setEnabled(true).setDeferThreshold(5));

Other changes

feature: [Java] forward enableManagedSettings on SessionConfig/ResumeSessionConfig to opt into enterprise managed-settings enforcement at session bootstrap (#1925)
feature: [Java] expose agentId(), parentAgentId(), and interactionType() on CopilotRequestContext in request-handler callbacks (#1949)
... (truncated)

1.0.7-preview.3

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.7-preview.3</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.7-preview.3")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.7-preview.3'

Feature: tool search configuration

Sessions can now configure tool search behavior via ToolSearchConfig on SessionConfig. Tool search keeps the model's active tool set small by deferring MCP and external tools until needed. (#1933)

var config = new SessionConfig()
    .setToolSearch(new ToolSearchConfig()
        .setEnabled(true)
        .setDeferThreshold(20));
var session = client.createSession(config).get();

Other changes

improvement: [Java] updated Javadoc examples to reference current model IDs (#1978)

New contributors

@rinceyuan made their first contribution in #1978

... (truncated)

1.0.7-preview.2

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.7-preview.2</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.7-preview.2")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.7-preview.2'

Changes since java/v1.0.7-preview.1

improvement: [Java] document native runtime bundling strategy (ADR-007): chose per-platform classifier JARs (DJL-style) with JNA bindings over Panama FFM, including decision rationale and monolithic uber-jar support via maven-assembly-plugin (#1966)

Generated by Release Changelog Generator · sonnet46 738.2K

1.0.7-preview.1

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.7-preview.1</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.7-preview.1")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.7-preview.1'

Feature: request handler context now exposes agent metadata

CopilotRequestContext now includes agentId, parentAgentId, and interactionType fields, giving request handlers visibility into which agent is making an LLM inference call and whether it is a subagent. (#1949)

client.setRequestHandler((context, chain) -> {
    System.out.println("Agent: " + context.getAgentId());
    System.out.println("Parent: " + context.getParentAgentId());
    System.out.println("Interaction: " + context.getInteractionType());
    return chain.apply(context);
});

Generated by Release Changelog Generator · sonnet46 747.2K

1.0.7-preview.0

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.7-preview.0</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.7-preview.0")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.7-preview.0'

Feature: opt in to enterprise managed-settings enforcement

SessionConfig and ResumeSessionConfig now support an enableManagedSettings flag. When set to true, the runtime enforces organizational bypass-permissions policies at session creation using the session's GitHub token. (#1925)

var session = client.createSession(
    new SessionConfig().setEnableManagedSettings(true)
).get();

Generated by Release Changelog Generator · sonnet46 2.3M

1.0.6

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.6</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.6")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.6'

Feature: inline lambda tool definitions

Developers can now define tools directly at the call site using ToolDefinition.from(...) with typed lambda handlers and Param.of(...) parameter metadata — no separate annotated class required. Async variants (fromAsync) and ToolInvocation context injection (fromWithToolInvocation) are also available. (#1895)

ToolDefinition greet = ToolDefinition.from(
    "greet", "Greets a user by name",
    Param.of(String.class, "name", "The user's name"),
    name -> "Hello, " + name + "!");

Other changes

bugfix: [Java] preserve explicit null map values in JSON-RPC params so user setting clears reach the CLI (#1906)
feature: [Java] add experimental onGitHubTelemetry callback on CopilotClientOptions for receiving forwarded GitHub telemetry events (#1835)

Generated by Release Changelog Generator · sonnet46 2.5M

1.0.6-preview.1

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.6-preview.1</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.6-preview.1")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.6-preview.1'

Feature: experimental GitHub telemetry forwarding

The Java SDK now supports forwarding per-session GitHub telemetry events to your application. Set onGitHubTelemetry on CopilotClientOptions to receive gitHubTelemetry.event notifications from the runtime; the client automatically opts every session it creates or resumes into telemetry forwarding when the handler is present. (#1835)

CopilotClientOptions options = new CopilotClientOptions()
    .setOnGitHubTelemetry(notification -> {
        // process per-session GitHub telemetry event
        return CompletableFuture.completedFuture(null);
    });

Note: This is an experimental feature (@CopilotExperimental) and may change or be removed without notice.

Generated by Release Changelog Generator · sonnet46 977.2K

1.0.6-preview.0

What's Changed

Update @github/copilot to 1.0.66 by @github-actions[bot] in Update @github/copilot to 1.0.66 github/copilot-sdk#1859
Update @github/copilot to 1.0.67 by @github-actions[bot] in Update @github/copilot to 1.0.67 github/copilot-sdk#1860
Expose new session options across SDKs by @stephentoub in Expose new session options across SDKs github/copilot-sdk#1865
Fix MCP OAuth resume order in Node.js SDK by @MackinnonBuck in Fix MCP OAuth resume order in Node.js SDK github/copilot-sdk#1861
docs: update billing information for GitHub Copilot SDK usage by @coleflennikenmsft in docs: update billing information for GitHub Copilot SDK usage github/copilot-sdk#1854
docs: add session limits guidance by @szabta89 in docs: add session limits guidance github/copilot-sdk#1856
Stream Anthropic /messages responses in E2E fake handlers by @stephentoub in Stream Anthropic /messages responses in E2E fake handlers github/copilot-sdk#1868
[changelog] Add changelog for java/v1.0.5-01 by @github-actions[bot] in [changelog] Add changelog for java/v1.0.5-01 github/copilot-sdk#1871
[changelog] Add changelog for v1.0.5 by @github-actions[bot] in [changelog] Add changelog for v1.0.5 github/copilot-sdk#1869
Add experimental GitHub telemetry redirection across all SDKs by @MackinnonBuck in Add experimental GitHub telemetry redirection across all SDKs github/copilot-sdk#1835

New Contributors

@coleflennikenmsft made their first contribution in docs: update billing information for GitHub Copilot SDK usage github/copilot-sdk#1854
@szabta89 made their first contribution in docs: add session limits guidance github/copilot-sdk#1856

Full Changelog: github/copilot-sdk@rust/v1.0.5-preview.1...rust/v1.0.6-preview.0

1.0.5

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.5</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.5")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.5'

Feature: annotation-based tool API (`@CopilotTool`)

The Java SDK now includes a high-level, annotation-driven tool API. Annotate methods with @CopilotTool and parameters with @CopilotToolParam to define tools — a JSR-269 annotation processor generates metadata at compile time with no runtime reflection. Use ToolDefinition.fromObject() to register tools with minimal boilerplate. (#1792)

public class WeatherTools {
    `@CopilotTool`("Get the current weather for a given city")
    public String getWeather(
            `@CopilotToolParam`(value = "The city to get weather for", required = true) String city,
            `@CopilotToolParam`(value = "Temperature unit: celsius or fahrenheit", defaultValue = "celsius") String unit) {
        // implementation
    }
}

List<ToolDefinition> tools = ToolDefinition.fromObject(new WeatherTools());
SessionConfig config = new SessionConfig().setTools(tools);

Feature: `ToolInvocation` injection in `@CopilotTool` methods

... (truncated)

1.0.5-preview.1

What's Changed

Fix flaky C# permission E2E assertions by @roji in Fix flaky C# permission E2E assertions github/copilot-sdk#1827
Update @github/copilot to 1.0.66-2 by @github-actions[bot] in Update @github/copilot to 1.0.66-2 github/copilot-sdk#1828
[Java] Support hidden ToolInvocation injection in @CopilotTool methods by @edburns with @Copilot in [Java] Support hidden ToolInvocation injection in @CopilotTool methods github/copilot-sdk#1832
Rename Param annotation to CopilotToolParam in Java SDK by @edburns with @Copilot in Rename Param annotation to CopilotToolParam in Java SDK github/copilot-sdk#1838
Add SDK MCP OAuth host token handlers by @roji in Add SDK MCP OAuth host token handlers github/copilot-sdk#1669

New Contributors

@roji made their first contribution in Fix flaky C# permission E2E assertions github/copilot-sdk#1827

Full Changelog: github/copilot-sdk@rust/v1.0.5-preview.0...rust/v1.0.5-preview.1

1.0.5-preview.0

What's Changed

Add sessionId to BYOK provider-token callback; rename to bearerTokenProvider by @SteveSandersonMS in Add sessionId to BYOK provider-token callback; rename to bearerTokenProvider github/copilot-sdk#1796
Fix block-remove-before-merge workflow failing on merge_group events by @edburns with @Copilot in Fix block-remove-before-merge workflow failing on merge_group events github/copilot-sdk#1798
Sunbrye/fix azure managed identity tabs by @sunbrye in Sunbrye/fix azure managed identity tabs github/copilot-sdk#1801
Make abort E2E snapshots tolerate timing variants by @stephentoub in Make abort E2E snapshots tolerate timing variants github/copilot-sdk#1808
Java: Implement @CopilotTool ergonomics by @edburns in Java: Implement @CopilotTool ergonomics github/copilot-sdk#1792
[changelog] Add changelog for java/v1.0.4 by @github-actions[bot] in [changelog] Add changelog for java/v1.0.4 github/copilot-sdk#1795
Update @github/copilot to 1.0.66-1 by @github-actions[bot] in Update @github/copilot to 1.0.66-1 github/copilot-sdk#1819
Add GitHub-anchored attachment variants to Attachment enum by @pallaviraiturkar0 in Add GitHub-anchored attachment variants to Attachment enum github/copilot-sdk#1823

New Contributors

@pallaviraiturkar0 made their first contribution in Add GitHub-anchored attachment variants to Attachment enum github/copilot-sdk#1823

Full Changelog: github/copilot-sdk@rust/v1.0.4...rust/v1.0.5-preview.0

1.0.4

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.4</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.4")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.4'

Feature: HTTP request callback support

Register a CopilotRequestHandler on the client to intercept every outbound LLM inference HTTP or WebSocket request — for both BYOK and CAPI — and mutate, replace, or fully forward it. Useful for logging, header injection, model substitution, or custom routing. (#1689, #1775, #1784)

final class MyHandler extends CopilotRequestHandler {
    `@Override`
    protected HttpResponse<InputStream> sendRequest(HttpRequest request, CopilotRequestContext ctx) throws Exception {
        HttpRequest mutated = HttpRequest.newBuilder(request, (n, v) -> true)
                .header("X-Debug-Session", ctx.sessionId() == null ? "none" : ctx.sessionId())
                .build();
        return super.sendRequest(mutated, ctx);
    }
}

CopilotClient client = new CopilotClient(
    new CopilotClientOptions().setRequestHandler(new MyHandler()));

Feature: `getBearerToken` callback for BYOK providers (Managed Identity)

... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

--- updated-dependencies: - dependency-name: GitHub.Copilot.SDK dependency-version: 1.0.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-20T08:17:48Z

Labels

The following labels could not be found: squad:belanna. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

…e NU5104 Reviewer findings on PR #1519 (SDK 1.14.0-rc1 / GitHub.Copilot.SDK 1.0.7 upgrade) both confirmed against real CI logs and fixed: 1. Native payload propagation. Microsoft.Agents.AI.GitHub.Copilot ships GitHub.Copilot.SDK's CLI-download build/ targets to transitive consumers via a buildTransitive/ bridge that defaults to the SDK version the adapter itself was packed against (1.0.5, its nuspec dependency floor), not the version Squad.Agents.AI actually references (1.0.7). Verified in PR #1519 run 29856026557: "Build package" downloaded Copilot CLI 1.0.71 (src/Squad.Agents.AI has the direct GitHub.Copilot.SDK PackageReference), while "Build tests" and "Build sample" downloaded the stale CLI 1.0.67 on both ubuntu-latest and windows-latest, because neither project has that direct reference. Fixed via the documented override contract (_MicrosoftAgentsAICopilotSdkVersion) that Microsoft.Agents.AI.GitHub.Copilot.targets itself exposes for exactly this purpose: - Directory.Build.props sets it repo-wide from a new single source of truth, SquadCopilotSdkVersion, fixing test/Squad.Agents.AI.Tests and samples/Squad.Agents.AI.Sample. - Squad.Agents.AI.csproj generates and packs its own buildTransitive/Squad.Agents.AI.props at pack time (mirroring how the adapter package itself does it) so REAL external NuGet consumers of Squad.Agents.AI get the same fix, not just this repo's internal ProjectReference-based projects. - GitHub.Copilot.SDK PackageReference now uses $(SquadCopilotSdkVersion) instead of a literal, so the two can never drift apart again. Added scripts/verify-squad-agents-ai-consumer.ps1, a hermetic consumer-level packaging check: packs Squad.Agents.AI, restores a scratch consumer against only the local nupkg + nuget.org, builds it for the runner's RID, and asserts the native Copilot CLI executable and runtime.node-derived library land under runtimes/*/native/ at the expected CLI version, with no stale 1.0.67 payload anywhere. Wired into squad-agents-ai-ci.yml (runs on both ubuntu-latest and windows-latest), alongside a lighter in-repo regression guard that checks the same thing for src/test/sample directly. Neither check executes the downloaded CLI binary or touches package source/TLS policy. 2. NU5104. Squad.Agents.AI was versioned as stable (0.5.5) while depending on prerelease Microsoft.Agents.AI.GitHub.Copilot 1.14.0-rc1, so `dotnet pack` emitted NU5104. Bumped to 0.5.6-rc1 (smallest correct next prerelease, matching the adapter's own "-rc1" convention) instead of suppressing the warning, since a genuinely mixed stable/prerelease dependency graph is exactly what NU5104 exists to flag. Verified `dotnet pack` no longer emits NU5104. dev->main promotions already require bumping <Version> by hand before a stable release (see squad-agents-ai-release.yml), so this does not block a future GA publish once Microsoft.Agents.AI.GitHub.Copilot itself leaves prerelease. Validated locally: single resolved GitHub.Copilot.SDK 1.0.7 across net8.0/net9.0/net10.0 for all three projects, no NU1605/NU1608/NU5104, no vulnerable packages, 82/82 tests passing on all three TFMs, and a real scratch PackageReference-only consumer (no ProjectReference, no Directory.Build.props visible) correctly attempting Copilot CLI 1.0.71 (not 1.0.67). Actual binary download could not be exercised end-to-end in this sandboxed dev environment (outbound TLS to registry.npmjs.org is blocked here, independent of CLI version); this is expected to complete normally on GitHub-hosted runners exactly as the existing CI already does today. Refs #1519, #1508 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 44f53a4e-d384-4c60-a43d-cfc158160f1f

…ub.Copilot.SDK to 1.0.7 (#1519) Upgrades Microsoft.Agents.AI.GitHub.Copilot from 1.11.0-rc1 to 1.14.0-rc1 and the direct GitHub.Copilot.SDK reference from 1.0.3 to 1.0.7 in src/Squad.Agents.AI/Squad.Agents.AI.csproj, together, since 1.14.0-rc1 requires GitHub.Copilot.SDK >= 1.0.5. Supersedes the SDK only Dependabot PR #1508. Fixes transitive native Copilot CLI payload propagation: Microsoft.Agents.AI.GitHub.Copilot ships GitHub.Copilot.SDK's CLI download build/ targets to transitive consumers via a buildTransitive bridge that otherwise resolves the SDK version the adapter itself was packed against (1.0.5, CLI 1.0.67) rather than the version this repo references (1.0.7, CLI 1.0.71). New Directory.Build.props and a generated buildTransitive/Squad.Agents.AI.props (built with System.Xml.Linq, packed into Squad.Agents.AI's own nupkg) set the documented _MicrosoftAgentsAICopilotSdkVersion override so test/Squad.Agents.AI.Tests, the sample project, and real external NuGet consumers all resolve the same CLI build as src/Squad.Agents.AI itself. Bumps Squad.Agents.AI's package version from 0.5.5 to 0.5.6-rc1, a prerelease matching the adapter's own -rc1 channel, resolving NU5104 ("stable package should not have prerelease dependency") instead of suppressing it. Adds a hermetic, cross-platform consumer packaging guard (scripts/verify-squad-agents-ai-consumer.ps1, wired into squad-agents-ai-ci.yml on ubuntu-latest and windows-latest) that packs Squad.Agents.AI, restores a scratch consumer pinned to the local nupkg via NuGet Package Source Mapping, verifies the restored package's SHA512 against the freshly packed bytes, builds for the runner's RID, and asserts the native Copilot CLI executable and runtime.node-derived library land under runtimes/*/native/ at the expected version with no stale 1.0.67 payload, without ever executing the downloaded binary. Refs #1519, #1508

tamirdresher · 2026-07-21T19:48:39Z

Superseded by #1519, now merged into dev (merge commit 667271b).

#1519 upgrades both Microsoft.Agents.AI.GitHub.Copilot (to 1.14.0-rc1) and GitHub.Copilot.SDK (to 1.0.7) together, which this PR alone did not do, and the 1.14.0-rc1 adapter requires GitHub.Copilot.SDK >= 1.0.5, so an SDK-only bump left a version-range mismatch. #1519 also fixed a transitive native Copilot CLI payload propagation bug (test/sample and any external consumer of Squad.Agents.AI were resolving a stale CLI build), added Windows and Linux consumer-level packaging validation, and moved Squad.Agents.AI to a matching prerelease version to keep dotnet pack clean.

Thank you for the original dependency bump, it was the right direction and helped confirm the version floor. Closing this one as superseded.

dependabot · 2026-07-21T19:48:48Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

deps: Bump GitHub.Copilot.SDK from 1.0.3 to 1.0.7

49921e9

--- updated-dependencies: - dependency-name: GitHub.Copilot.SDK dependency-version: 1.0.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 20, 2026

dependabot Bot requested review from bradygaster and tamirdresher as code owners July 20, 2026 08:17

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 20, 2026

dependabot Bot mentioned this pull request Jul 20, 2026

deps: Bump GitHub.Copilot.SDK from 1.0.3 to 1.0.6 #1471

Closed

tamirdresher mentioned this pull request Jul 21, 2026

deps: upgrade Microsoft.Agents.AI.GitHub.Copilot to 1.14.0-rc1 + GitHub.Copilot.SDK to 1.0.7 #1519

Merged

tamirdresher closed this Jul 21, 2026

dependabot Bot deleted the dependabot/nuget/src/Squad.Agents.AI/GitHub.Copilot.SDK-1.0.7 branch July 21, 2026 19:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

deps: Bump GitHub.Copilot.SDK from 1.0.3 to 1.0.7#1508

deps: Bump GitHub.Copilot.SDK from 1.0.3 to 1.0.7#1508
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/nuget/src/Squad.Agents.AI/GitHub.Copilot.SDK-1.0.7

dependabot Bot commented on behalf of github Jul 20, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 20, 2026

Uh oh!

tamirdresher commented Jul 21, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jul 20, 2026

1.0.7

Installation

Maven

Gradle (Kotlin DSL)

Gradle (Groovy DSL)

Feature: opaque metadata passthrough for tool definitions

Feature: tool search configuration support

Other changes

1.0.7-preview.3

Installation

Maven

Gradle (Kotlin DSL)

Gradle (Groovy DSL)

Feature: tool search configuration

Other changes

New contributors

1.0.7-preview.2

Installation

Maven

Gradle (Kotlin DSL)

Gradle (Groovy DSL)

Changes since java/v1.0.7-preview.1

1.0.7-preview.1

Installation

Maven

Gradle (Kotlin DSL)

Gradle (Groovy DSL)

Feature: request handler context now exposes agent metadata

1.0.7-preview.0

Installation

Maven

Gradle (Kotlin DSL)

Gradle (Groovy DSL)

Feature: opt in to enterprise managed-settings enforcement

1.0.6

Installation

Maven

Gradle (Kotlin DSL)

Gradle (Groovy DSL)

Feature: inline lambda tool definitions

Other changes

1.0.6-preview.1

Installation

Maven

Gradle (Kotlin DSL)

Gradle (Groovy DSL)

Feature: experimental GitHub telemetry forwarding

1.0.6-preview.0

What's Changed

New Contributors

1.0.5

Installation

Maven

Gradle (Kotlin DSL)

Gradle (Groovy DSL)

Feature: annotation-based tool API (@​CopilotTool)

Feature: ToolInvocation injection in @​CopilotTool methods

1.0.5-preview.1

What's Changed

New Contributors

1.0.5-preview.0

What's Changed

New Contributors

1.0.4

Installation

Maven

Gradle (Kotlin DSL)

Gradle (Groovy DSL)

Feature: HTTP request callback support

Feature: getBearerToken callback for BYOK providers (Managed Identity)

Uh oh!

dependabot Bot commented on behalf of github Jul 20, 2026

Labels

Uh oh!

tamirdresher commented Jul 21, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 21, 2026

Uh oh!

Feature: annotation-based tool API (`@CopilotTool`)

Feature: `ToolInvocation` injection in `@CopilotTool` methods

Feature: `getBearerToken` callback for BYOK providers (Managed Identity)