Skip to content

Bump GitHub.Copilot.SDK and 4 others#27

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/eng/skill-validator/src/all-other-nuget-28a6e52e81
Closed

Bump GitHub.Copilot.SDK and 4 others#27
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/eng/skill-validator/src/all-other-nuget-28a6e52e81

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 9, 2026

Copy link
Copy Markdown
Contributor

Updated GitHub.Copilot.SDK from 0.3.0 to 1.0.6.

Release notes

Sourced from GitHub.Copilot.SDK's releases.

1.0.6

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.6</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.6")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.6'

Feature: inline lambda tool definitions

Developers can now define tools directly at the call site using ToolDefinition.from(...) with typed lambda handlers and Param.of(...) parameter metadata — no separate annotated class required. Async variants (fromAsync) and ToolInvocation context injection (fromWithToolInvocation) are also available. (#​1895)

ToolDefinition greet = ToolDefinition.from(
    "greet", "Greets a user by name",
    Param.of(String.class, "name", "The user's name"),
    name -> "Hello, " + name + "!");

Other changes

  • bugfix: [Java] preserve explicit null map values in JSON-RPC params so user setting clears reach the CLI (#​1906)
  • feature: [Java] add experimental onGitHubTelemetry callback on CopilotClientOptions for receiving forwarded GitHub telemetry events (#​1835)

Generated by Release Changelog Generator · sonnet46 2.5M

1.0.6-preview.1

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.6-preview.1</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.6-preview.1")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.6-preview.1'

Feature: experimental GitHub telemetry forwarding

The Java SDK now supports forwarding per-session GitHub telemetry events to your application. Set onGitHubTelemetry on CopilotClientOptions to receive gitHubTelemetry.event notifications from the runtime; the client automatically opts every session it creates or resumes into telemetry forwarding when the handler is present. (#​1835)

CopilotClientOptions options = new CopilotClientOptions()
    .setOnGitHubTelemetry(notification -> {
        // process per-session GitHub telemetry event
        return CompletableFuture.completedFuture(null);
    });

Note: This is an experimental feature (@​CopilotExperimental) and may change or be removed without notice.

Generated by Release Changelog Generator · sonnet46 977.2K

1.0.6-preview.0

What's Changed

New Contributors

Full Changelog: github/copilot-sdk@rust/v1.0.5-preview.1...rust/v1.0.6-preview.0

1.0.5

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.5</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.5")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.5'

Feature: annotation-based tool API (@​CopilotTool)

The Java SDK now includes a high-level, annotation-driven tool API. Annotate methods with @​CopilotTool and parameters with @​CopilotToolParam to define tools — a JSR-269 annotation processor generates metadata at compile time with no runtime reflection. Use ToolDefinition.fromObject() to register tools with minimal boilerplate. (#​1792)

public class WeatherTools {
    `@​CopilotTool`("Get the current weather for a given city")
    public String getWeather(
            `@​CopilotToolParam`(value = "The city to get weather for", required = true) String city,
            `@​CopilotToolParam`(value = "Temperature unit: celsius or fahrenheit", defaultValue = "celsius") String unit) {
        // implementation
    }
}

List<ToolDefinition> tools = ToolDefinition.fromObject(new WeatherTools());
SessionConfig config = new SessionConfig().setTools(tools);

Feature: ToolInvocation injection in @​CopilotTool methods

... (truncated)

1.0.5-preview.1

What's Changed

New Contributors

Full Changelog: github/copilot-sdk@rust/v1.0.5-preview.0...rust/v1.0.5-preview.1

1.0.5-preview.0

What's Changed

New Contributors

Full Changelog: github/copilot-sdk@rust/v1.0.4...rust/v1.0.5-preview.0

1.0.4

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.4</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.4")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.4'

Feature: HTTP request callback support

Register a CopilotRequestHandler on the client to intercept every outbound LLM inference HTTP or WebSocket request — for both BYOK and CAPI — and mutate, replace, or fully forward it. Useful for logging, header injection, model substitution, or custom routing. (#​1689, #​1775, #​1784)

final class MyHandler extends CopilotRequestHandler {
    `@​Override`
    protected HttpResponse<InputStream> sendRequest(HttpRequest request, CopilotRequestContext ctx) throws Exception {
        HttpRequest mutated = HttpRequest.newBuilder(request, (n, v) -> true)
                .header("X-Debug-Session", ctx.sessionId() == null ? "none" : ctx.sessionId())
                .build();
        return super.sendRequest(mutated, ctx);
    }
}

CopilotClient client = new CopilotClient(
    new CopilotClientOptions().setRequestHandler(new MyHandler()));

Feature: getBearerToken callback for BYOK providers (Managed Identity)

... (truncated)

1.0.2

What's Changed

New Contributors

Full Changelog: github/copilot-sdk@rust/v1.0.1...rust/v1.0.2

1.0.1

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.1</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.1")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.1'

Feature: @​CopilotExperimental compile-time gate for experimental APIs

Experimental SDK APIs are now guarded by the @​CopilotExperimental annotation. Using them causes a compile error by default; opt in by annotating the consuming class or method with @​AllowCopilotExperimental, or pass -Acopilot.experimental.allowed=true to the Java compiler. (#​1601)

`@​AllowCopilotExperimental`
public class MyHandler {
    // may use `@​CopilotExperimental` APIs here
}

Feature: open-canvases snapshot on CopilotSession

CopilotSession.getOpenCanvases() now returns the live set of canvas instances open for the session, bringing the Java SDK to parity with the other SDK languages. The snapshot is seeded from the session create/resume response and kept current via session.canvas.opened and session.canvas.closed events. (#​1606)

List<OpenCanvasInstance> open = session.getOpenCanvases();

Other changes

... (truncated)

1.0.0

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 View on Maven Central

📖 Documentation · Javadoc

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.0</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.0")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.0'

What's Changed

Full Changelog: github/copilot-sdk@java/v1.0.0-beta-12-java.1...java/v1.0.0

1.0.0-beta-12-java.1

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.0-beta-12-java.1</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.0-beta-12-java.1")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.0-beta-12-java.1'

Feature: slash command responses accessible via RPC

Applications can now retrieve responses from slash commands. Previously the ability to invoke slash commands existed, but responses were not surfaced through the RPC layer. (#​1520)

// Send a slash command and receive its response via the session RPC
CompletableFuture<AssistantMessage> response = session.sendMessage("/my-command args");

Feature: session.mcp.apps.callTool returns JsonNode

session.mcp.apps.callTool() previously returned CompletableFuture<Void> due to a codegen gap; it now correctly returns CompletableFuture<JsonNode>, making the tool result accessible. (#​1523)

JsonNode result = session.rpc().mcp().apps().callTool(params).get();

Generated by Release Changelog Generator · ● 2.2M

1.0.0-beta-10-java.5

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.0-beta-10-java.5</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.0-beta-10-java.5")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.0-beta-10-java.5'

Changes since java/v1.0.0-beta-10-java.4

  • improvement: add reflection-based Jackson round-trip test coverage for all generated event/type classes (#​1509)
  • improvement: fix JaCoCo coverage badge script to use correct generated-types package name (#​1499)
  • improvement: Java release pipeline improvements (#​1514)

New contributors

  • @​examon made their first contribution in #​1323

Full Changelog: github/copilot-sdk@java/v1.0.0-beta-10-java.4...java/v1.0.0-beta-10-java.5

Generated by Release Changelog Generator · ● 2.9M

1.0.0-beta-10-java.4

Installation

i️ Public Preview: This is the official Java SDK for GitHub Copilot. This repository treats the official .NET and Node.js SDKs for GitHub Copilot as reference implementations. These SDKs are all officially supported as GitHub open source projects. The Java implementation follows the backward compatibility guarantees offered by the reference implementations.

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 View on Maven Central

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.0-beta-10-java.4</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.0-beta-10-java.4")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.0-beta-10-java.4'

Changes since java/v1.0.0-beta-10-java.3

  • improvement: fix release pipeline token permissions to enable publishing to Maven Central

Full Changelog: github/copilot-sdk@java/v1.0.0-beta-10-java.3...java/v1.0.0-beta-10-java.4

Generated by Release Changelog Generator · ● 2.7M

1.0.0-beta-10-java.3

Installation

ℹ️ Public Preview: This is the official Java SDK for GitHub Copilot. This repository treats the official .NET and Node.js SDKs for GitHub Copilot as reference implementations. These SDKs are all officially supported as GitHub open source projects. The Java implementation follows the backward compatibility guarantees offered by the reference implementations.

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 View on Maven Central

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.0-beta-10-java.3</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.0-beta-10-java.3")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.0-beta-10-java.3'

Full Changelog: github/copilot-sdk@java/v1.0.0-beta-10-java.1...java/v1.0.0-beta-10-java.3

1.0.0-beta.12

What's Changed

New Contributors

Full Changelog: github/copilot-sdk@rust/v1.0.0-beta.10...rust/v1.0.0-beta.12

1.0.0-beta.10

What's Changed

New Contributors

Full Changelog: github/copilot-sdk@rust/v1.0.0-beta.9...rust/v1.0.0-beta.10

1.0.0-beta.9

What's Changed

New Contributors

Full Changelog: github/copilot-sdk@rust/v1.0.0-beta.8...rust/v1.0.0-beta.9

1.0.0-beta.8

What's Changed

Full Changelog: github/copilot-sdk@rust/v1.0.0-beta.7...rust/v1.0.0-beta.8

1.0.0-beta.7

What's Changed

Full Changelog: github/copilot-sdk@rust/v1.0.0-beta.6...rust/v1.0.0-beta.7

1.0.0-beta.6

What's Changed

1.0.0-beta.4

What's Changed

New Contributors

Full Changelog: github/copilot-sdk@rust-v0.1.0...rust/v1.0.0-beta.4

1.0.0-beta.3

Feature: mode handler APIs for plan approval and rate-limit recovery

Applications can now register callbacks for exitPlanMode.request and autoModeSwitch.request from the Copilot runtime, giving full control over plan-mode transitions and automatic model switching after rate-limit events. (#​1228)

const session = await client.createSession({
  onExitPlanMode: async (request) => ({ approved: true }),
  onAutoModeSwitch: (request) => "yes",
});
var session = await client.CreateSessionAsync(new SessionConfig
{
    OnExitPlanMode = (request, _) => Task.FromResult(new ExitPlanModeResult { Approved = true }),
    OnAutoModeSwitch = (request, _) => Task.FromResult(AutoModeSwitchResponse.Yes),
});
  • Python: on_exit_plan_mode / on_auto_mode_switch kwargs on create_session()
  • Go: ExitPlanModeHandler / AutoModeSwitchHandler fields on SessionConfig

Feature: SDK tracing diagnostics

The .NET, Python, and Rust SDKs now emit structured diagnostic logs covering CLI startup, TCP connection, JSON-RPC request timing, session lifecycle, and error paths. (#​1217)

var client = new CopilotClient(new CopilotClientOptions
{
    Logger = loggerFactory.CreateLogger<CopilotClient>(),
});

Python emits logs via stdlib logging under copilot.* loggers at DEBUG level. Rust uses tracing structured fields; wire up a tracing_subscriber as usual.

Feature: enableSessionTelemetry session option

A new enableSessionTelemetry option on SessionConfig and ResumeSessionConfig lets applications explicitly enable or disable the runtime's internal session telemetry. (#​1224)

const session = await client.createSession({ enableSessionTelemetry: true });
var session = await client.CreateSessionAsync(new SessionConfig { EnableSessionTelemetry = true });

Other changes

  • bugfix: [C#] session-event enums are now string-backed readonly structs, preventing deserialization failures when the runtime adds new enum values (#​1226)
    ... (truncated)

1.0.0-beta.2

Feature: remote session support

Applications can now enable remote session support across all SDKs, providing parity with the CLI's --remote flag. There are two complementary mechanisms: a client-level option that enables remote for all sessions, and per-session RPC methods to toggle remote on demand. (#​1192)

Always-on via client option:

const client = new CopilotClient({ remote: true });
session.on("session.info", (event) => {
  if (event.data.infoType === "remote") {
    console.log("Remote URL:", event.data.url);
  }
});
var client = new CopilotClient(new CopilotClientOptions { Remote = true });
session.OnSessionInfo += (e) => {
    if (e.InfoType == "remote")
        Console.WriteLine($"Remote URL: {e.Url}");
};

On-demand via RPC:

const result = await session.rpc.remote.enable();
console.log("Remote URL:", result.url);
await session.rpc.remote.disable();
var result = await session.Rpc.Remote.EnableAsync();
Console.WriteLine($"Remote URL: {result.Url}");
await session.Rpc.Remote.DisableAsync();
  • Python: await session.rpc.remote.enable() / session.rpc.remote.disable()
  • Go: session.RPC.Remote.Enable(ctx) / session.RPC.Remote.Disable(ctx)

Other changes

  • improvement: [Rust] align Rust SDK public surface with C#, Go, Python, and TypeScript — removes autoModeSwitch, exitPlanMode, disabled_mcp_servers; adds available_tools/disabled_skills to ResumeSessionConfig; expands tool results with binary payloads and MCP CallToolResult conversion (#​1212)
  • improvement: [Rust] internalize env_value_mode for cross-SDK parity — envValueMode is now always sent as "direct" on the wire, consistent with all other SDKs (#​1215)

Generated by Release Changelog Generator · ● 225.2K

1.0.0-beta.1

This is the first beta release of the Copilot SDK. The release includes all features we have committed to including in the upcoming General Availability (GA) release.

But note - we're not stopping here! Before GA, we still plan to add more top-requested features, as well as any critical bugfixes. We'll also carry out a final round of API reviews and will likely make further breaking changes to streamline naming before it locks down at 1.0.0.

Highlights of 1.0.0 Beta 1 include custom instruction directories, configurable data directories, TCP connection tokens for headless servers, and a more self-contained .NET distribution (eliminating third-party dependencies).

New features

Custom instruction directories

Sessions can now specify additional directories to search for custom instruction files via the instructionDirectories option on session create and resume config. This lets applications point the CLI at project-specific or team-shared instruction files beyond the default locations. (#​1190)

// TypeScript
const session = await client.createSession({
  onPermissionRequest: approveAll,
  instructionDirectories: [
    "/repo/.copilot/instructions",
    "/shared/team-instructions",
  ],
});
// C#
var session = await client.CreateSessionAsync(new() {
    OnPermissionRequest = PermissionHandler.ApproveAll,
    InstructionDirectories = ["/repo/.copilot/instructions", "/shared/team-instructions"],
});
  • Python: await client.create_session(on_permission_request=..., instruction_directories=["/repo/.copilot/instructions"])
  • Go: client.CreateSession(ctx, &copilot.SessionConfig{InstructionDirectories: []string{"/repo/.copilot/instructions"}})

TCP connection token

When the SDK spawns a CLI server in TCP mode, it now auto-generates a connection token to authenticate the handshake — closing the loopback listener to unauthorized connections by default. For applications connecting to an externally managed TCP server that requires a token, the new tcpConnectionToken client option lets you supply it explicitly. (#​1176)

// TypeScript
// After starting runtime with env var COPILOT_CONNECTION_TOKEN=<some_uuid>
const client = new CopilotClient({
  cliUrl: "localhost:3000",
  tcpConnectionToken: "<some_uuid>",
});
 ... (truncated)

Commits viewable in [compare view](https://github.com/github/copilot-sdk/compare/v0.3.0...java/v1.0.6).
</details>

Updated [MessagePack](https://github.com/MessagePack-CSharp/MessagePack-CSharp) from 2.5.301 to 3.1.8.

<details>
<summary>Release notes</summary>

_Sourced from [MessagePack's releases](https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases)._

## 3.1.7

## What's Changed

* Add `scoped` to `MessagePackWriter.Write(ReadOnlySpan<T>)` methods by @​AArnott in https://github.com/MessagePack-CSharp/MessagePack-CSharp/pull/2271
* Fix security issues in master by @​AArnott in https://github.com/MessagePack-CSharp/MessagePack-CSharp/pull/2274

## Security release details

This release fixes 3 high severity and 9 moderate severity security vulnerabilities.

### High severity advisory fixes

- 26d4e743 GHSA-382j-8mxh-c7x2 Reject invalid DateTime ext lengths for CWE-789
- b9cb6050 GHSA-vh6j-jc39-fggf Use iteration for skipping msgpack structures for CWE-674
- 719e690a GHSA-hv8m-jj95-wg3x Bound LZ4 input reads for CWE-125

### Moderage severity advisory fixes

- 2b5a500a GHSA-v72x-2h86-7f8m Guard LZ4 decompression length for CWE-409
- f093bdc1 GHSA-qhmf-xw27-6rqr Reject nested typeless blocklist bypass for CWE-502
- f077798e GHSA-2f33-pr97-265q Default MVC input formatter to UntrustedData for CWE-1188
- 25a3493e GHSA-2x83-8g95-xh59 Limit untrusted ExpandoObject maps for CWE-407
- b414e6df GHSA-wfr3-xj75-pfwh Guard dynamic union depth for CWE-674
- 0555f07c GHSA-w567-gjr2-hm5j Validate Unity blit lengths for CWE-789
- 9b5783a7 GHSA-cxmj-83gh-fp49 Fix CWE-789 multidimensional array allocation validation
- f96fcf05 GHSA-q2h6-ghwm-5qm8 Use secure lookup comparer for CWE-407
- b3af7cf7 GHSA-cj9g-3mj2-g8vv Guard JSON conversion depth for CWE-674
- 66ad0894 GHSA-cj9g-3mj2-g8vv Avoid JSON separator recursion for CWE-674
- 082ba7da GHSA-cj9g-3mj2-g8vv Guard typeless JSON depth for CWE-674

### Fixes with no security advisory

- fb0fe9f0 Honor TypeFormatter options hooks for CWE-470
- c1c06a6f Fix WriteRawX methods to advance by written length
- 46c6a0fe Fix CWE-190 map header length overflow

**Full Changelog**: https://github.com/MessagePack-CSharp/MessagePack-CSharp/compare/v3.1.6...v3.1.7

## 3.1.6

## What's Changed
* Add several known unsafe 'gadgets' to the disallow list by @​AArnott in https://github.com/MessagePack-CSharp/MessagePack-CSharp/pull/2270


**Full Changelog**: https://github.com/MessagePack-CSharp/MessagePack-CSharp/compare/v3.1.5...v3.1.6

## 3.1.5

## What's Changed
* Remove unneeded GetTypeInfo() calls by @​Bykiev in https://github.com/MessagePack-CSharp/MessagePack-CSharp/pull/2206
* Use 'Write' instead of 'WriteInt32' for union type keys by @​VictorNicollet in https://github.com/MessagePack-CSharp/MessagePack-CSharp/pull/2212
* Fix various disposable issues by @​Bykiev in https://github.com/MessagePack-CSharp/MessagePack-CSharp/pull/2224
* fix: prevent StackOverflow in Equals with recursive generic constraints by @​khuongntrd in https://github.com/MessagePack-CSharp/MessagePack-CSharp/pull/2226
* Add more types to the default disallow list of named types to be deserialized by @​AArnott in https://github.com/MessagePack-CSharp/MessagePack-CSharp/pull/2256
* Fix release workflow by @​AArnott in https://github.com/MessagePack-CSharp/MessagePack-CSharp/pull/2268
* ~~Fix Incorrect DateTimeOffset Serializer by @​T0PP1ng in https://github.com/MessagePack-CSharp/MessagePack-CSharp/pull/2225~~
* Revert DateTimeOffset encoding change by @​AArnott in https://github.com/MessagePack-CSharp/MessagePack-CSharp/pull/2262

## New Contributors
* @​Bykiev made their first contribution in https://github.com/MessagePack-CSharp/MessagePack-CSharp/pull/2206
* @​VictorNicollet made their first contribution in https://github.com/MessagePack-CSharp/MessagePack-CSharp/pull/2212
* @​T0PP1ng made their first contribution in https://github.com/MessagePack-CSharp/MessagePack-CSharp/pull/2225
* @​khuongntrd made their first contribution in https://github.com/MessagePack-CSharp/MessagePack-CSharp/pull/2226

**Full Changelog**: https://github.com/MessagePack-CSharp/MessagePack-CSharp/compare/v3.1.4...v3.1.5

## 3.1.4

## What's Changed
* Fix SkipClrVisibilityChecks to notice private fields in base classes by @​AArnott in https://github.com/MessagePack-CSharp/MessagePack-CSharp/pull/2153
* Promote analyzers to AnalyzerReleases.Shipped.md by @​hanachiru in https://github.com/MessagePack-CSharp/MessagePack-CSharp/pull/2169
* Add memory size check to `GetMemoryCheckResult` by @​AArnott in https://github.com/MessagePack-C...

_Description...

_Description has been truncated_

@dependabot
Bump GitHub.Copilot.SDK and 4 others
5a3aa5b 
Bumps GitHub.Copilot.SDK from 0.3.0 to 1.0.6
Bumps MessagePack from 2.5.301 to 3.1.8
Bumps Nerdbank.MessagePack from 1.2.4 to 1.2.36
Bumps Vecc.YamlDotNet.Analyzers.StaticGenerator from 18.0.0 to 18.1.0
Bumps YamlDotNet from 18.0.0 to 18.1.0

---
updated-dependencies:
- dependency-name: GitHub.Copilot.SDK
  dependency-version: 1.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-other-nuget
- dependency-name: MessagePack
  dependency-version: 3.1.8
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-other-nuget
- dependency-name: Nerdbank.MessagePack
  dependency-version: 1.2.36
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-other-nuget
- dependency-name: Vecc.YamlDotNet.Analyzers.StaticGenerator
  dependency-version: 18.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-other-nuget
- dependency-name: YamlDotNet
  dependency-version: 18.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-other-nuget
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Jul 9, 2026
@dependabot dependabot Bot mentioned this pull request Jul 9, 2026
Closed
@dependabot @github

dependabot Bot commented on behalf of github Jul 9, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #28.

@dependabot dependabot Bot closed this Jul 9, 2026
@dependabot dependabot Bot deleted the dependabot/nuget/eng/skill-validator/src/all-other-nuget-28a6e52e81 branch July 9, 2026 06:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants