From 5a3aa5bfff694d022cde48bafb9933b65ac2e56d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 06:09:08 +0000
Subject: [PATCH] Bump GitHub.Copilot.SDK and 4 others

Bumps GitHub.Copilot.SDK from 0.3.0 to 1.0.6
Bumps MessagePack from 2.5.301 to 3.1.8
Bumps Nerdbank.MessagePack from 1.2.4 to 1.2.36
Bumps Vecc.YamlDotNet.Analyzers.StaticGenerator from 18.0.0 to 18.1.0
Bumps YamlDotNet from 18.0.0 to 18.1.0

---
updated-dependencies:
- dependency-name: GitHub.Copilot.SDK
  dependency-version: 1.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-other-nuget
- dependency-name: MessagePack
  dependency-version: 3.1.8
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-other-nuget
- dependency-name: Nerdbank.MessagePack
  dependency-version: 1.2.36
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-other-nuget
- dependency-name: Vecc.YamlDotNet.Analyzers.StaticGenerator
  dependency-version: 18.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-other-nuget
- dependency-name: YamlDotNet
  dependency-version: 18.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-other-nuget
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 eng/skill-validator/src/SkillValidator.csproj | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/eng/skill-validator/src/SkillValidator.csproj b/eng/skill-validator/src/SkillValidator.csproj
index ef0ded3..efd6a18 100644
--- a/eng/skill-validator/src/SkillValidator.csproj
+++ b/eng/skill-validator/src/SkillValidator.csproj
@@ -42,16 +42,16 @@
     <PackageReference Include="Microsoft.ML.Tokenizers.Data.Cl100kBase" Version="2.0.0" />
     <PackageReference Include="System.CommandLine" Version="2.0.9" />
     <!-- external -->
-    <PackageReference Include="GitHub.Copilot.SDK" Version="0.3.0" />
-    <PackageReference Include="YamlDotNet" Version="18.0.0" />
-    <PackageReference Include="Vecc.YamlDotNet.Analyzers.StaticGenerator" Version="18.0.0" />
+    <PackageReference Include="GitHub.Copilot.SDK" Version="1.0.6" />
+    <PackageReference Include="YamlDotNet" Version="18.1.0" />
+    <PackageReference Include="Vecc.YamlDotNet.Analyzers.StaticGenerator" Version="18.1.0" />
 
     <!--
       Transitive pin: GitHub.Copilot.SDK still drags in Nerdbank.MessagePack
       1.0.2 which has a known high-severity vulnerability (GHSA-2cwq-pwfr-wcw3).
       Fixed in 1.1.62.  Drop this once the upstream chain bumps past 1.1.62.
     -->
-    <PackageReference Include="Nerdbank.MessagePack" Version="1.2.4" />
+    <PackageReference Include="Nerdbank.MessagePack" Version="1.2.36" />
 
     <!--
       Transitive pin: GitHub.Copilot.SDK -> StreamJsonRpc 2.24.84 drags in
@@ -59,7 +59,7 @@
       (GHSA-hv8m-jj95-wg3x, out-of-bounds read in LZ4 decompression). Patched in
       the v2 line as of 2.5.301.  Drop this once the upstream chain bumps past it.
     -->
-    <PackageReference Include="MessagePack" Version="2.5.301" />
+    <PackageReference Include="MessagePack" Version="3.1.8" />
 
     <!--
       Transitive pin: Microsoft.Data.Sqlite 10.0.7 -> SQLitePCLRaw.bundle_e_sqlite3