deps: Bump the microsoft-packages group with 5 updates

[dependabot]

Updated GitHub.Copilot.SDK from 1.0.13 to 1.0.14.

Release notes

Sourced from GitHub.Copilot.SDK's releases.

1.0.14

Feature: typed message provenance for user, system, and agent sources

Messages sent through the SDK can now carry typed source provenance, distinguishing human user input, internal system injections, and identified agent- senders, so recipients can reliably tell agent input from human authorization. (#​2573)

await session.send("Looks good to me.", { source: "agent-reviewer" });

await session.send("Looks good to me.", source=AgentMessageSource("reviewer"))

Feature: Auto model routing Fast tier

Sessions using auto model routing can now select the fast tier alongside the existing efficiency, balance, and intelligence tiers, giving integrators a latency-focused routing preset across all six SDKs. (#​2669)

await session.setAutoTier("fast");

Feature: force-refresh managed settings cache

The new managedSettings.clearCache RPC method wipes the persistent server-policy cache and drops the runtime's in-memory retained policy, giving hosts a primitive for a "force refresh account policy" action. (#​2438)

await client.rpc.managedSettings.clearCache();

await client.Rpc.ManagedSettings.ClearCacheAsync();

Feature: Rust SDK model allowlists

SessionConfig and ResumeSessionConfig in the Rust SDK now accept an optional allowed_models list, letting hosts restrict which model IDs a session may use without duplicating runtime validation. (#​2512)

let config = SessionConfig::default().with_allowed_models(["gpt-4o", "claude-3.7-sonnet"]);

Other changes

• feature: [Core] add factory pause checkpoints for the Node.js Agent Factories API, letting a paused run resume without losing invocation limits or execution identity (#​2537)
• feature: forward the optional host OAuth client metadata URL across all six SDKs on session create and resume (#​2258)
• feature: [TypeScript] add max_output_tokens to the model capabilities override, previously unreachable without an unsafe cast (#​2569)
• bugfix: [.NET] include Copilot CLI runtime assets in PackAsTool packages so dotnet pack --no-build produces a working tool (#​2557)
• bugfix: apply the runtime's connection_close callback-quiescence contract consistently across all six in-process C ABI adapters, preventing races with freed callback state during disposal (#​2610, #​2622)
• bugfix: [Rust] fix codegen for CLI 1.0.84 schemas, correctly mapping the CatalogTrustEligibility unknown value and re-exporting shared session-event types (#​2631)
• bugfix: [C#] fix codegen for runtime schema unions, unblocking single-variant anyOf/oneOf handling (#​2656)
• bugfix: [Rust] isolate the hostless in-process runtime cache from the bundled CLI cache to prevent cross-deletion of a shared executable (#​2659)
  ... (truncated)

1.0.14-preview.1

Feature: pause and resume durable factory runs at checkpoints

Agent Factories can now pause deliberately instead of only stopping at hard limits. Call ctx.pause(key) inside a factory body to register a durable, one-shot checkpoint that ends the current attempt; resuming replays the journal and returns from that checkpoint instead of redoing prior work. Callers can also pause a running attempt from outside the factory body. (#​2537)

await ctx.step("prepare", prepareInput);
await ctx.pause("review-ready");
await ctx.agent("Review the prepared input");

const paused = await session.factory.pause(runId);

[!WARNING]

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by Release Changelog Generator · copilot · auto · 52.5 AIC · ⌖ 5.57 AIC · ⊞ 10.3K

1.0.14-preview.0

Feature: typed message provenance across all SDKs

Sending a message can now declare its source as user, system, or an identified agent (serialized as agent-<id>), so recipients can reliably distinguish human input from system injections and forwarded agent output. Ordinary sends remain unaffected: source stays omitted unless the caller opts in. (#​2573)

await session.send({ prompt: "Reviewed and approved.", source: "agent-reviewer" });

await session.send(prompt="Reviewed and approved.", source=AgentMessageSource("reviewer"))

session.Send(ctx, copilot.SendOptions{Source: copilot.MessageSourceAgent("reviewer")})

• C#: Source = MessageSource.Agent("reviewer")
• Java: .setSource(MessageSource.agent("reviewer"))
• Rust: .with_source(MessageSource::Agent("reviewer".into()))

Feature: force-refresh enterprise managed settings

A new managedSettings.clearCache RPC wipes the persistent server-policy cache and drops the runtime's in-memory retained policy, so hosts can wire up a "sync account policy" action (for example VS Code's Developer: Sync Account Policy command). It's available in TypeScript, C#, Python, Go, and Rust; Java support follows once the underlying CLI release is pinned. (#​2438)

await client.rpc.managedSettings.clearCache();

Other changes

• feature: [TypeScript] allow setting max_output_tokens on model capability overrides (#​2569)
• feature: forward an optional host OAuth client metadata document URL across all six SDKs (#​2258)
• bugfix: [.NET] include Copilot CLI runtime assets in PackAsTool publish output so packed tools install correctly (#​2557)
• bugfix: [Rust] isolate GitHub token callbacks from the request-routing loop so a callback panic can no longer stall session requests (#​2567)
• bugfix: [Python, Node.js] serialize concurrent client startup so racing callers reuse the same connection instead of launching duplicate runtimes (#​2570)
• bugfix: [.NET] fix a vulnerable transitive SourceLink dependency (#​2587)
• bugfix: fix in-process callback reclamation and FFI close responsiveness across all six SDKs to prevent use-after-free races and event-loop stalls during disposal (#​2610, #​2622)
• bugfix: [Rust] fix codegen for CLI 1.0.84 schemas (#​2631)

[!WARNING]

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

... (truncated)

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.11 to 10.0.12.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Hosting.Abstractions from 10.0.11 to 10.0.12.

Release notes

Sourced from Microsoft.Extensions.Hosting.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging.Abstractions from 10.0.11 to 10.0.12.

Release notes

Sourced from Microsoft.Extensions.Logging.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Options from 10.0.11 to 10.0.12.

Release notes

Sourced from Microsoft.Extensions.Options's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[DeDuva]

Needs refresh — superseded. Head SHA: fe24f7b0d3a6e4c6a5ae8d5fbbde3a2d6f17080d

Every update this PR proposes is already on dev:

Package	This PR	On dev now	Landed via
GitHub.Copilot.SDK	1.0.13 → 1.0.14	1.0.14	#160
Microsoft.Extensions.Options	10.0.11 → 10.0.12	10.0.12	#159
Microsoft.Extensions.DependencyInjection.Abstractions	10.0.11 → 10.0.12	10.0.12	#159
Microsoft.Extensions.Hosting.Abstractions	10.0.11 → 10.0.12	10.0.12	#159
Microsoft.Extensions.Logging.Abstractions	10.0.11 → 10.0.12	10.0.12	#159

Nothing is wrong with this PR — it was a correct proposal, and its green .NET ubuntu-latest / .NET windows-latest run was in fact the evidence that GitHub.Copilot.SDK 1.0.14 and Microsoft.Extensions.* 10.0.12 build together in this csproj, which is the combination dev now carries. It is simply redundant as of today's run, so it is being left open rather than merged.

Rebasing should leave an empty diff and let Dependabot retire it.

@dependabot rebase

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.