Skip to content

chore(deps): bump @github/copilot from 1.0.21 to 1.0.51#187

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/github/copilot-1.0.51
Closed

chore(deps): bump @github/copilot from 1.0.21 to 1.0.51#187
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/github/copilot-1.0.51

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 21, 2026

Bumps @github/copilot from 1.0.21 to 1.0.51.

Release notes

Sourced from @​github/copilot's releases.

1.0.51

2026-05-20

  • --session-id=<id> resumes known sessions or tasks, and starts new sessions with a specific UUID
  • /remote commands now respect organization remote control and view from cloud policy and show a clear error when disabled
  • /remote command can now be used while the agent is working
  • Customizable status line in the terminal footer displays session info such as model, context window, git branch, and more
  • MCP tool loading at startup is faster for users with many HTTP-based MCP servers
  • Settings file no longer accumulates unrelated config keys when settings are updated
  • Add /security-review slash command to review code changes for security vulnerabilities (experimental)
  • Add preMcpToolCall hook for hook providers to control outgoing MCP request metadata
  • Add /chronicle cost-tips subcommand for personalized token usage and cost reduction recommendations
  • MCP servers using OAuth stay connected when authentication was performed in a separate session
  • GFM tables and blockquotes inside list items render correctly without a floating top border
  • Experimental mode indicator now appears persistently in the app header instead of as a one-time notification
  • Loading indicator color matches the active mode (plan, autopilot, shell)
  • Session naming works correctly for usage-based billing users
  • Pressing Enter on a highlighted subcommand completion inserts the selection instead of submitting the partial command
  • Use default release notes when publishing a release with no changelog entries
  • Editor launched with Ctrl+G no longer steals keystrokes or requires double keypresses
  • /memory show displays documentation links for learning about and managing Copilot Memory
  • Add terminalProgress setting to enable or disable OSC 9;4 terminal progress indicators
  • postToolUse hooks can now inject additionalContext into successful tool results
  • Only show remote session startup failure when remote mode is explicitly requested via --remote or enabled in user configuration
  • Shell tool calls succeed even when the model omits the description parameter
  • Ensure input token usage includes cached, update token formatting to clarify
  • Login prompt more clearly warns when token storage falls back to insecure plain text config file
  • GitHub MCP web search tool is available immediately without requiring tool search
  • Secret scanning now covers commit messages and PR descriptions, redacting secrets before they are published
  • Input area grows responsively with terminal height instead of capping at 3 lines

1.0.51-3

Added

  • Add /security-review slash command to review code changes for security vulnerabilities
  • Add preMcpToolCall hook for hook providers to control outgoing MCP request metadata
  • Add /chronicle cost-tips subcommand for personalized token usage and cost reduction recommendations

Improved

  • Experimental mode indicator now appears persistently in the app header instead of as a one-time notification
  • Loading indicator color matches the active mode (plan, autopilot, shell)

Fixed

  • MCP servers using OAuth stay connected when authentication was performed in a separate session
  • GFM tables and blockquotes inside list items render correctly without a floating top border

1.0.51-2

Improved

  • /memory show displays documentation links for learning about and managing Copilot Memory

Fixed

... (truncated)

Changelog

Sourced from @​github/copilot's changelog.

1.0.51 - 2026-05-20

  • --session-id=<id> resumes known sessions or tasks, and starts new sessions with a specific UUID
  • /remote commands now respect organization remote control and view from cloud policy and show a clear error when disabled
  • /remote command can now be used while the agent is working
  • Customizable status line in the terminal footer displays session info such as model, context window, git branch, and more
  • MCP tool loading at startup is faster for users with many HTTP-based MCP servers
  • Settings file no longer accumulates unrelated config keys when settings are updated
  • Add /security-review slash command to review code changes for security vulnerabilities
  • Add preMcpToolCall hook for hook providers to control outgoing MCP request metadata
  • Add /chronicle cost-tips subcommand for personalized token usage and cost reduction recommendations
  • MCP servers using OAuth stay connected when authentication was performed in a separate session
  • GFM tables and blockquotes inside list items render correctly without a floating top border
  • Experimental mode indicator now appears persistently in the app header instead of as a one-time notification
  • Loading indicator color matches the active mode (plan, autopilot, shell)
  • Session naming works correctly for usage-based billing users
  • Pressing Enter on a highlighted subcommand completion inserts the selection instead of submitting the partial command
  • Use default release notes when publishing a release with no changelog entries
  • Editor launched with Ctrl+G no longer steals keystrokes or requires double keypresses
  • /memory show displays documentation links for learning about and managing Copilot Memory
  • Add terminalProgress setting to enable or disable OSC 9;4 terminal progress indicators
  • postToolUse hooks can now inject additionalContext into successful tool results
  • Only show remote session startup failure when remote mode is explicitly requested via --remote or enabled in user configuration
  • Shell tool calls succeed even when the model omits the description parameter
  • Ensure input token usage includes cached, update token formatting to clarify
  • Login prompt more clearly warns when token storage falls back to insecure plain text config file
  • GitHub MCP web search tool is available immediately without requiring tool search
  • Secret scanning now covers commit messages and PR descriptions, redacting secrets before they are published
  • Input area grows responsively with terminal height instead of capping at 3 lines

1.0.49 - 2026-05-18

  • postToolUse hook additionalContext is now injected as a system message for the model instead of being silently discarded
  • Mouse clicks in the prompt correctly position cursor when input contains wide characters (CJK, emoji)
  • Add /chronicle search subcommand to search all session content by keyword or topic
  • /user switch reuses the fetched user list and shows a loading spinner on first open
  • MCP servers using static OAuth clients correctly persist registration for token refreshes
  • Add support for running the CLI on Alpine Linux (musl libc)
  • Add /exit print option to print the session to the terminal before exiting
  • Add /rubber-duck command to get an independent critique of the agent's current work
  • Add /session id subcommand to display the current session ID and copy it to the clipboard
  • Add auth.redirectPort config option for MCP servers to pin the OAuth callback to a fixed port
  • Add /memory on|off|show slash command to enable, disable, or view memory status (persistent)
  • Add copilot plugin update --all to update all installed plugins at once
  • Add /rubber-duck command to invoke the rubber duck agent for an independent critique (experimental)
  • Input prompt collapses to a single line when empty and grows naturally as you type
  • File diffs are correctly reported to ACP clients for all edit tool types
  • Repo hooks in .github/hooks/ now load in prompt mode (-p) when the folder is already trusted
  • Fix extra line in timeline entries
  • Box drawing and block characters render correctly on Windows terminals not using UTF-8 code page

... (truncated)

Commits
  • d0b5734 Update changelog.md for version 1.0.49
  • 196c5f6 Update changelog.md for version 1.0.48
  • 4328afb Update changelog.md for version 1.0.47
  • 5b5dd40 Update changelog.md for version 1.0.46
  • fd2900c Update changelog.md for version 1.0.45
  • 41b4018 Update changelog.md for version 1.0.44
  • bee20d0 Update changelog.md for version 1.0.43
  • 5ab6de6 Update changelog.md for version 1.0.42
  • ac346d1 Update changelog.md for version 1.0.41
  • cc85e32 Update changelog.md for version 1.0.40
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [@github/copilot](https://github.com/github/copilot-cli) from 1.0.21 to 1.0.51.
- [Release notes](https://github.com/github/copilot-cli/releases)
- [Changelog](https://github.com/github/copilot-cli/blob/main/changelog.md)
- [Commits](github/copilot-cli@v1.0.21...v1.0.51)

---
updated-dependencies:
- dependency-name: "@github/copilot"
  dependency-version: 1.0.51
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 21, 2026
@dependabot dependabot Bot requested a review from devartifex as a code owner May 21, 2026 18:09
@devartifex
Copy link
Copy Markdown
Owner

Deferred — @github/copilot (the CLI) is not a direct dependency of this app (we depend on @github/copilot-sdk which was just bumped to 1.0.0-beta.8 in #189).

devartifex added a commit that referenced this pull request May 28, 2026
…on support (#189)

* feat(sdk): upgrade to @github/copilot-sdk 1.0.0-beta.8 + remote sessions

Consolidates 9 dependabot PRs and migrates to the latest beta SDK so we can
expose cloud / remote-session control (the feature behind 'copilot --remote' /
'/remote' in the official CLI).

Dependency bumps
- @github/copilot-sdk 0.2.2 -> 1.0.0-beta.8 (pinned exact; beta API)
- @sveltejs/kit ^2.57.1 -> ^2.61.1
- svelte ^5.55.4 -> ^5.55.9
- vite ^8.0.8 -> ^8.0.14, ws ^8.18 -> ^8.21
- dompurify ^3.4 -> ^3.4.7, marked ^18.0.2 -> ^18.0.4
- dev-deps group: @playwright/test, vite-plugin-svelte, @types/node,
  @vitest/coverage-v8, jsdom, lint-staged, svelte-check

SDK breaking-change migration
- CopilotClient now takes a RuntimeConnection (forStdio/forUri/forTcp)
- githubToken -> gitHubToken; cwd -> workingDirectory
- COPILOT_HOME env -> baseDirectory option
- SystemPromptSection -> SystemMessageSection
- onPermissionRequest optional; getQuota({}) takes params object
- hook input shapes: timestamp is Date; cwd dropped from session/error hooks;
  workingDirectory required on Pre/Post tool hook inputs
- session-fs.ts removed (runtime writes session-state under baseDirectory)

New SDK features wired in (all unit tested)
- Per-session remoteSession mode (off | export | on), threaded through
  CreateSessionOptions and the WS new-session handler; persisted setting field
  added (default off).
- Cloud sessions REST wrapper (cloud-sessions.ts) talking to
  api.individual.githubcopilot.com/agents/sessions (the same endpoint the
  official CLI uses for the remote-sessions view), with timeout + graceful
  error handling.
- New GET /api/sessions/remote returns authenticated user's cloud sessions
  (passes through 401/403, 502 on other upstream errors).
- New GET /api/sessions/last using client.getLastSessionId() +
  getSessionMetadata() for one-tap resume.
- Graceful + forceful shutdown: destroyPoolEntry races client.stop() against
  a 5s timer and falls back to client.forceStop() to prevent hung CLI subs.

Config
- New ENABLE_REMOTE_SESSIONS env var (default true) wired into
  CopilotClient.enableRemoteSessions; sessions still need per-session opt-in.

Verification
- svelte-check: 0 errors / 0 warnings
- vitest: 430 passed (41 files); +21 new tests covering cloud-sessions,
  /api/sessions/remote, /api/sessions/last, remoteSession threading, and
  forceStop fallback
- npm run build succeeds; smoke boot: /health returns 200

Supersedes dependabot PRs #170, #172, #177, #178, #181, #182, #185, #186, #188.
Out of scope (left open with comments): #176 (node:26-slim too new),
#167 (release-please v5 breaking inputs), #187 (@github/copilot CLI is not a
direct dep). Playwright E2E should be run in CI.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: drop /api/sessions/remote — endpoint does not exist in public CLI

Investigating node_modules/@github/copilot/app.js (the official CLI we
ship in node_modules via @github/copilot-sdk peer) showed that the
hostname I guessed earlier — api.individual.githubcopilot.com — is not
present anywhere in the bundle. The CLI only uses:

  - api.githubcopilot.com (default)
  - api.enterprise.githubcopilot.com (enterprise plan)

And the agents endpoint is per-session (PUT/GET /agents/sessions/{id}),
not a list. There is no 'list all my remote sessions' REST endpoint in
the public CLI; that view is rendered on github.com using a different,
internal API path that requires a Copilot bearer (exchanged from the GH
OAuth token via a CLI-internal endpoint not exposed to integrators).

Rather than ship a route that returns 502/empty results, I'm removing:

  - src/lib/server/copilot/cloud-sessions.ts
  - src/lib/server/copilot/cloud-sessions.test.ts
  - src/routes/api/sessions/remote/+server.ts
  - src/routes/api/sessions/remote/server.test.ts

What stays (and is fully tested):

  - Per-session remoteSession mode wired through CreateSessionOptions
    and the WS new-session handler — the SDK takes care of publishing
    to api.githubcopilot.com under the hood when this is set.
  - GET /api/sessions/last (uses real SDK getLastSessionId + getSessionMetadata)
  - destroyPoolEntry forceStop fallback
  - ENABLE_REMOTE_SESSIONS env var

New Playwright spec tests/sessions-endpoints.spec.ts hits the new
/api/sessions/last on a real built server and verifies the 401 path
end-to-end. Full suite: 57 desktop Playwright tests + 419 unit tests
all pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs(readme): SDK 1.0.0-beta.8 + remote-session publishing

- Bump copilot-sdk badge & tech-stack line to v1.0.0-beta.8.
- New Features bullets for remote session publishing and resume-last-session.
- New 'Remote session publishing' subsection under CLI <-> Browser Sync
  explaining what off/export/on do AND being explicit about what's NOT in
  this release (no in-app remote session browser, no steering of other
  remote sessions) so future users don't expect that capability.
- Add ENABLE_REMOTE_SESSIONS env var to the All-options table.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: address rubber-duck PR review findings

- MCP server config: rename cwd → workingDirectory (SDK 1.0 rename)
- /api/sessions/last: pass copilotConfigDir to createCopilotClient so
  the SDK reads from the correct baseDirectory
- new-session handler: honor ENABLE_REMOTE_SESSIONS server kill-switch;
  ignore client-supplied remoteSession when the feature is disabled
- destroyPoolEntry: clear timeout on stop() resolve, attach .catch() to
  the in-flight stop promise (no unhandled rejection), guard forceStop
  with a settled flag so it cannot race a clean stop

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci: bump e2e timeout from 15 to 30 minutes

The Playwright desktop suite grew to 126 tests. With 1 CI worker
and 2 retries (CI defaults from playwright.config.ts), the worst-
case wall clock now exceeds the prior 15-minute budget — every
recent CI run on this repo (including dependabot PRs) has been
hitting the job timeout during the Playwright step.

This is a narrow infra fix: extend the budget so the suite can
actually finish. It does not skip, disable, or weaken any tests.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 28, 2026

Looks like @github/copilot is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this May 28, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/github/copilot-1.0.51 branch May 28, 2026 12:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant