Skip to content

Bump GitHub.Copilot.SDK and Microsoft.Agents.AI.GitHub.Copilot - #2279

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/multi-c83a6441ec
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/multi-c83a6441ec

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 17, 2026

Copy link
Copy Markdown
Contributor

Updated GitHub.Copilot.SDK from 1.0.13 to 1.0.14.

Release notes

Sourced from GitHub.Copilot.SDK's releases.

1.0.14

Feature: typed message provenance for user, system, and agent sources

Messages sent through the SDK can now carry typed source provenance, distinguishing human user input, internal system injections, and identified agent- senders, so recipients can reliably tell agent input from human authorization. (#​2573)

await session.send("Looks good to me.", { source: "agent-reviewer" });
await session.send("Looks good to me.", source=AgentMessageSource("reviewer"))

Feature: Auto model routing Fast tier

Sessions using auto model routing can now select the fast tier alongside the existing efficiency, balance, and intelligence tiers, giving integrators a latency-focused routing preset across all six SDKs. (#​2669)

await session.setAutoTier("fast");

Feature: force-refresh managed settings cache

The new managedSettings.clearCache RPC method wipes the persistent server-policy cache and drops the runtime's in-memory retained policy, giving hosts a primitive for a "force refresh account policy" action. (#​2438)

await client.rpc.managedSettings.clearCache();
await client.Rpc.ManagedSettings.ClearCacheAsync();

Feature: Rust SDK model allowlists

SessionConfig and ResumeSessionConfig in the Rust SDK now accept an optional allowed_models list, letting hosts restrict which model IDs a session may use without duplicating runtime validation. (#​2512)

let config = SessionConfig::default().with_allowed_models(["gpt-4o", "claude-3.7-sonnet"]);

Other changes

  • feature: [Core] add factory pause checkpoints for the Node.js Agent Factories API, letting a paused run resume without losing invocation limits or execution identity (#​2537)
  • feature: forward the optional host OAuth client metadata URL across all six SDKs on session create and resume (#​2258)
  • feature: [TypeScript] add max_output_tokens to the model capabilities override, previously unreachable without an unsafe cast (#​2569)
  • bugfix: [.NET] include Copilot CLI runtime assets in PackAsTool packages so dotnet pack --no-build produces a working tool (#​2557)
  • bugfix: apply the runtime's connection_close callback-quiescence contract consistently across all six in-process C ABI adapters, preventing races with freed callback state during disposal (#​2610, #​2622)
  • bugfix: [Rust] fix codegen for CLI 1.0.84 schemas, correctly mapping the CatalogTrustEligibility unknown value and re-exporting shared session-event types (#​2631)
  • bugfix: [C#] fix codegen for runtime schema unions, unblocking single-variant anyOf/oneOf handling (#​2656)
  • bugfix: [Rust] isolate the hostless in-process runtime cache from the bundled CLI cache to prevent cross-deletion of a shared executable (#​2659)
    ... (truncated)

1.0.14-preview.1

Feature: pause and resume durable factory runs at checkpoints

Agent Factories can now pause deliberately instead of only stopping at hard limits. Call ctx.pause(key) inside a factory body to register a durable, one-shot checkpoint that ends the current attempt; resuming replays the journal and returns from that checkpoint instead of redoing prior work. Callers can also pause a running attempt from outside the factory body. (#​2537)

await ctx.step("prepare", prepareInput);
await ctx.pause("review-ready");
await ctx.agent("Review the prepared input");
const paused = await session.factory.pause(runId);

[!WARNING]

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by Release Changelog Generator · copilot · auto · 52.5 AIC · ⌖ 5.57 AIC · ⊞ 10.3K

1.0.14-preview.0

Feature: typed message provenance across all SDKs

Sending a message can now declare its source as user, system, or an identified agent (serialized as agent-<id>), so recipients can reliably distinguish human input from system injections and forwarded agent output. Ordinary sends remain unaffected: source stays omitted unless the caller opts in. (#​2573)

await session.send({ prompt: "Reviewed and approved.", source: "agent-reviewer" });
await session.send(prompt="Reviewed and approved.", source=AgentMessageSource("reviewer"))
session.Send(ctx, copilot.SendOptions{Source: copilot.MessageSourceAgent("reviewer")})
  • C#: Source = MessageSource.Agent("reviewer")
  • Java: .setSource(MessageSource.agent("reviewer"))
  • Rust: .with_source(MessageSource::Agent("reviewer".into()))

Feature: force-refresh enterprise managed settings

A new managedSettings.clearCache RPC wipes the persistent server-policy cache and drops the runtime's in-memory retained policy, so hosts can wire up a "sync account policy" action (for example VS Code's Developer: Sync Account Policy command). It's available in TypeScript, C#, Python, Go, and Rust; Java support follows once the underlying CLI release is pinned. (#​2438)

await client.rpc.managedSettings.clearCache();

Other changes

  • feature: [TypeScript] allow setting max_output_tokens on model capability overrides (#​2569)
  • feature: forward an optional host OAuth client metadata document URL across all six SDKs (#​2258)
  • bugfix: [.NET] include Copilot CLI runtime assets in PackAsTool publish output so packed tools install correctly (#​2557)
  • bugfix: [Rust] isolate GitHub token callbacks from the request-routing loop so a callback panic can no longer stall session requests (#​2567)
  • bugfix: [Python, Node.js] serialize concurrent client startup so racing callers reuse the same connection instead of launching duplicate runtimes (#​2570)
  • bugfix: [.NET] fix a vulnerable transitive SourceLink dependency (#​2587)
  • bugfix: fix in-process callback reclamation and FFI close responsiveness across all six SDKs to prevent use-after-free races and event-loop stalls during disposal (#​2610, #​2622)
  • bugfix: [Rust] fix codegen for CLI 1.0.84 schemas (#​2631)

[!WARNING]

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

... (truncated)

Commits viewable in compare view.

Updated Microsoft.Agents.AI.GitHub.Copilot from 1.22.0 to 1.25.0.

Release notes

Sourced from Microsoft.Agents.AI.GitHub.Copilot's releases.

1.25.0

Changes:

  • 1ab3430a4b6c8add9f08854c77544b0211a3f13c .NET: Dotnet: Add approval reuse considerations (#​9389)
  • 563eb3a9965f7c144ad697223320411c02fa349a .NET: terminate chat completions SSE stream with data: [DONE] (#​8532) [ #​8526 ]
  • 4964bdd1b2d55b8137cbc1bc85840181af05bda0 .NET: Update version for 1.25.0 release (#​9388)
  • 5abdadf262141b56f84111b89b607b2d6bd6ebaa .NET: Also include citations and error details in purview checks. (#​9375)
  • 74db3c11201f32b919781ebbb3de4f643150510b .NET: Fix reasoning remnants and handoff bounce-back (#​9174)
  • 6b57b5f4cb15ddb87a2ca4f9d958a80dd0fc8455 .NET: Upgrade A2A packages to 1.0.0-preview3 (#​9386)
  • 95feea605dbbe879f678602585c76fdb5a963b63 .NET: Automatically reject tool-approval requests that never receive a response (#​9152)
See More
  • 1b9879c58ac950ef235471209b4c5cb402972bab .NET: feat(dotnet): support closed-list workflow questions (#​9202) [ #​1530 ]
  • dcbbf7967afe877913275f1a445166a7ac301ab0 Bump the agent-memory group with 2 updates (#​9315)
  • b53d25ed1cd2f54ee5e5e5ed548bb2c5515022f3 .NET: fix: preserve agent continuation token when wrapped with UseOpenTelemetry (#​8265) [ #​8243 ]
  • f72bf952415a770a879aa19d8e397c82a765c9d0 .NET: [BREAKING] Decouple Cosmos chat metadata from partition-key strategy (#​9214)
  • 6e630f4796b84c0f72640b9cc914b7325254ad1d .NET: Isolate Foundry toolbox response cache (#​8848)
  • 1e722004da32080df18f66eae3558600333d4c92 Revert ".NET: [BREAKING] Request concise Harness progress without private reasoning (#​9004)" (#​9147)
  • 8254704d57dcc42b8542a0eeef79a25145a89e4d .NET: [BREAKING] Request concise Harness progress without private reasoning (#​9004)

This list of changes was auto generated.

1.24.0

Changes:

  • 245d4284a5018b7f446b5eac4d3add1fa5547229 .NET: Restore source-only release solution filter (#​9140) [ #​8537 ]
  • d0ccaa62761ec36c59c139940797978623fb630a .NET: Preserve explicit null session state across roundtrips (#​9012)
  • 279d97f75cb2e7eee885dcdc2c741ef7361ee903 .NET: Honor disabled recent search memory (#​9013)
  • 41e785fb9a3c853272ce0fbd2eb93364e9d1de13 .NET: Preserve lazy request messages through agent invocation (#​9017)
  • 9251bc9911d30f5035b4a75cd1c61f96c90f38a6 .NET: Update version for 1.24.0 release (#​9120)
  • 73a96cb1a90213dfc2b1d36e7c7250559fb28d5d .NET: Stabilize Anthropic agent package (#​9111) [ #​9110 ]
  • 0774607d8d3fa8a3f50cd5bda7b4c7ad400403f3 .NET: Reject sensitive declarative identifiers (#​9071)
  • 41c4f1c9b0242cfc3f2567db9f9c9a462982a4e7 .NET: Harden LocalCodeAct capability validation (#​9057)
See More
  • b9d24c8fb484c8330abe8bb9e7500ca3c3bbf46c .NET: test: add loopback destination regression coverage (#​9064)
  • bd5ab48cfdebb49b9223de0fc75c7141641927f3 .NET: Validate handoff request lifecycle before routing (#​8855)
  • 636e8562d1db4e678e0bb88f602e0bbc7318f6a4 .NET: Synchronize background task metadata and defer publication until session creation (#​8933)
  • 6ef0b73ed8ee5ae9a5cdc709edc5bfc9443d91cb .NET: Isolate GitHub Copilot attachment staging (#​8846)
  • 52fed574f05aa4c22ae4cc024679d501ec5f327a .NET: Preserve atomic cache creation across factory failures (#​8931)
  • a2f4506c0ba30cea7c9bbe907fc158c0db2cc6a3 .NET: Skip empty Foundry memory context messages (#​8932)
  • 501989469265894443ba0812264397aec986e4cd Improve MCP skill archive loading consistency (#​8937)
  • 2e8b58c06da252755c892963053f4e6b7a9417fc .NET: Return only the items between 'after' and 'before' when listing response input items (#​8872) [ #​8871 ]
  • a15c0197b2823f1197d3dc37f3411ffb0ba3cc15 .NET: document A2A authentication and tool authorization (#​8491)
  • d52db94e4b617e6fc76a13189b78d30546062481 .NET: Reject a MaxBatchSize outside 1..100 in CosmosChatHistoryProvider (#​8870) [ #​8869 ]
  • 99215f96dafa0e24491dcbc015d013f649a2b066 .NET: Update retired Claude model in 04_MultiModelService sample (#​8879) [ #​5074, #​8878 ]
  • 7634356a1de0fd5de287544113c34d32afeeba83 .NET: Fix Foundry MCP approval replay IDs (#​8873)
  • 2f5713f60e6e3036e2c21bf01068602ca1fa3a2e .NET: Preserve A2A run errors when session save fails (#​8877)
  • 2a7470a92c9bc5afb9581ccb90008f41c92a1a6a .NET: Publish synthetic terminal responses with their events (#​8885)
  • e23f3c89f29eed39ad921c21acc697a20fe066cd .NET: Validate HTTP header delimiters (#​8847)
  • 5343347312795ef589c8d8047326eb1b6ef3aa3c .NET: Allow compaction for per-service-call local chat history (#​8845)
  • 71e84a098dec7f4d4c2273759fb2ce5914419b91 .NET: Propagate ChatHistoryMemoryProvider caller cancellation (#​8813)
  • e626cef6c9536536d4dd8796ea7f1914af49596e .NET: Bind MCP approval headers to approved invocation (#​8834)
  • ba320332d496783c953246c00852f078e7594ea3 .NET: Reject protected values in declarative MCP invocations (#​8832)
  • 77f832ff1ac915ed3c4a1bddb12e43cb9aec0c86 .NET: fix(harness): honor cancellation while waiting for background agents (#​8805)
  • 202e85d0d8767180e24b5ef19e43f712a19e1953 .NET: Remove unused GitTag property (#​8827)
  • 763887452f371d8d03a67993ec7adcd95a0e18c2 .NET: Dispose AI context streaming enumerators (#​8812)
  • 7a98aa9f3c2136ce012e552f62286d7225b2f910 .NET: Honor a zero message limit in ValkeyChatHistoryProvider (#​8809)
  • 06e9b48937d5f6c46da8f89817e51364a10cfb19 .NET: Python: Add optional OAuth consent origin allowlist to Foundry hosting (#​8713)

This list of changes was auto generated.

1.23.0

Changes:

  • be01deccaf3dd7b85e03620145bc1a757c857827 .NET: Add origin pinning to Foundry toolbox MCP client (#​8721)
  • 0d6d2bb6b0b58f3aabdf170320ab90fc300d4c99 .NET: fix: declarative workflow http variables (#​8797)
  • 2024d4df4c4dd01b904fb9daaf56f5759801654a .NET: Fix workflow topology edge multiplicity comparison (#​8656)
  • 37ce872a85fed62cedfd7fffa2e0bd43f7d32b92 .NET: Store created external input messages (#​8606)
  • 1370903bd8e6eb8871781cd1fcc74f674c022e0b .NET: [BREAKING] Better support tool changes between runs (#​8754)
See More
  • 3f1f3b50b57ccabe7725f8a60539622d5f1ca7b4 .NET: Propagate TextSearchProvider caller cancellation (#​8796)
  • 238d7e2e9bb9b469be172460e612c89840aad1cc .NET: Validate Foundry client headers before transport (#​8715)
  • c804f32c983df56bacc9a8698fde9d50edc2df3e .NET: [BREAKING] Bump Azure.AI.Projects to 3.0.0-beta.3, OpenAI to 2.14.0, and MEAI to 10.10.1 (#​8730) [ dotnet/extensions#​7760, dotnet/extensions#​7761 ]
  • 93cf98a042c0f4eb8e1e180beeab9474bcd96811 .NET: Update AGUI SDK packages to 1.0.0 (#​8769)
  • 109234952ad417b0e9368beed633e438eb2e389d Clarify CodeAct guest packages and host network access (#​8781)
  • 6f1522a50b66f117da34cc25ea299ba24a528b15 Temporarily skip OpenAI integration tests while the CI API key is invalid (#​8767)
  • 2c46deb91e70ea6d7bbc99263147e0f470d52546 .NET: Clarify hosting authentication, authorization, and isolation guidance (#​8677)
  • 024dd9908bc19fa42f070cfaf7c3775c2b17f09b .NET/Python: Improve MCP skill resource validation (#​8690)
  • 8ff549d3f7219bac0a405621616ed72090ba13b9 .NET: Correct InvokeAzureAgent response output (#​8605)
  • 5ee3e87d6768eadb7c4cf91507659a6069850692 .NET: Remove redundant NuGet configuration (#​8719)
  • 622737258c73f730adca5130b7b82fbc03ff8838 Set better expecations for contributors (#​8706)
  • 30b9b8e06766b2038e366d32979357c2fc4b9def .NET: Only consume stored approval state when the run succeeds (#​8692)
  • 834eb7ff12c83aadee56d468e3b01b4f0fc4084c fix(dotnet): persist function results as user messages (#​8655)
  • 0bbb7245d408b6b7209eca58609ca53a52a66cec .NET: [BREAKING] fix: use allow list for configuration keys (#​8200)
  • a638ce136ed6e0457877373b0e377e1f1d33277d .NET: Fix forwarded request-port type validation (#​8657)
  • 76ccf3c44cee748aa582c446a7218f91289f2aac fix(dotnet): forward declarative Azure agent version (#​8658)
  • 11b8b80a2c904a36603c4445df5ddb07a55e6817 Use review App permissions for repair reactions (#​8669)
  • 74e8fe6da942ee991819ea861de1841243d7c0e1 Use the workflow token for fix-ci evidence (#​8667)
  • 173978ee93e0ffa5ef4ebdbfe2e94cd6f8e8a996 .NET: Add function replace support for function middleware (#​8615)
  • bf93c539d247a9df6f66055b711a3015438c8dce .NET: [BREAKING] Enforce approval response binding consistently (#​8641)
  • 646e116a4099a6dc0f689ff2dd8b41b31ba2bdae .NET: [BREAKING] Fix DevUI approval continuation (#​8423) [ #​6006 ]
  • 925f4f2c6c494eba2779f7f79de1ca95958f6d8a .NET: ci/dotnet vscode configuration (#​8537)
  • ec7114ffc8656a9b5c56be252f0411d22887c896 .NET: fix: a bug where invoke function tool could bypass approval (#​8403)
  • c5a8c8d37d7cf15b493fb838084f4954be6b0223 fix(core): distinguish absent tool call arguments from parse failures (#​8609)
  • 17b349f2150d5b90649998a32a067db07319649a docs(core): fix positional invocations in detect_media_type_from_base64 docstrings (#​8614)
  • eb74c8cceba97bc037413dcf25cfcf1aeab77634 fix(core): ensure add_usage_details returns copies and filters non-ints consistently (#​8613)
  • 02bd1ba1de43ca8d1206a5c61e86ffc0d6f44b12 fix(ag-ui): allow text events when response_format is a json schema dictionary (#​8604)
  • 7b626709dbce2c170030c388cea9e611738e5be5 ci: removes workflow based PR limit to use GitHub native feature (#​8603)
  • bb53fe15a8375426a98763bd43eed64762af3f07 test(ollama): narrow pytest.raises blocks to wrap only get_response in error tests (#​8611)
  • 894b0f6f0bd2d59202ef04d5898302e05cbb7264 samples: add McpDocsResearch declarative workflow showcasing agent-level MCP pattern (#​6054)
  • 42c22c001761340f47b279e89a4e06aedb5549d9 Bump GitHub.Copilot.SDK to 1.0.1 and forward session config properties (incl. per-session GitHubToken) (#​5735) [ #​6381 ]

This list of changes was auto generated.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps GitHub.Copilot.SDK from 1.0.13 to 1.0.14
Bumps Microsoft.Agents.AI.GitHub.Copilot from 1.22.0 to 1.25.0

---
updated-dependencies:
- dependency-name: GitHub.Copilot.SDK
  dependency-version: 1.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: Microsoft.Agents.AI.GitHub.Copilot
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file nuget NuGet dependency updates skip-nuget-publish Skips publishing to NuGet when merging to the `main` branch. labels Oct 17, 2026
@github-actions

Copy link
Copy Markdown
Contributor

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.sh | bash -s -- 2279

Or

  • Run remotely in PowerShell:
iex "& { $(irm https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.ps1) } 2279"

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file nuget NuGet dependency updates skip-nuget-publish Skips publishing to NuGet when merging to the `main` branch.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant