[deps-release-notes] copilot-cli — upstream release action items

[github-actions]

Rolling upstream release action items — copilot-cli

This is the single canonical tracking issue for action items from new copilot-cli releases. The update-awf-version workflow appends a comment here for each version bump going forward — the most recent activity lives in the comments below. This body consolidates everything filed so far.

Latest pinned version covered: 1.0.68

Consolidated history (earliest → latest)

1.0.48 → 1.0.56 (was #803)

• Security: secret scanning covers commit messages + PR descriptions (v1.0.51): Redacts secrets before publishing.
• Security: permissions.disableBypassPermissionsMode (v1.0.55): Prevents enabling allow-all/yolo mode; relevant for sandboxed pipelines.
• --session-id=<id> flag (v1.0.51): Resume/start sessions with a specific UUID — useful for pipeline correlation.
• postToolUse hook additionalContext injected as system message (v1.0.49): Instead of being discarded.
• preMcpToolCall hook (v1.0.51): Control outgoing MCP request metadata.
• deferred-tool-loading frontmatter for custom agents (v1.0.52): Reduces initial token overhead.
• MCP tools with both content + structuredContent surface both (v1.0.56): Review ado-aw MCP tools to ensure dual output is intentional.
• Context window tier selection (v1.0.52): Default ~200K vs 1M tokens enforced end-to-end.
• Claude Opus 4.8 support (v1.0.55).
• Deprecation: oauth.clientId/oauth.callbackPort → oauthClientId/auth.redirectPort (v1.0.52).

1.0.48 → 1.0.59 (was #843)

• Breaking: preToolUse hook errors now deny the tool call (v1.0.57): Previously hook errors silently allowed execution; now they block the call.
• Breaking: Remote JSON RPC enabled by default (v1.0.58): Verify this doesn't open unexpected network surface in AWF-sandboxed environments.
• Breaking: --plugin-dir skills take precedence over personal-home skills (v1.0.55): Skill resolution order: project > plugin-dir > personal > custom.
• ADO-only repos: built-in GitHub MCP server exposes only web_search (v1.0.57): Directly relevant to ado-aw; consider whether the GitHub MCP extension should account for ADO-repository detection.

1.0.48 → 1.0.60 (was #881)

• Alpine Linux (musl libc) support (v1.0.49): Now runs on Alpine-based containers.
• Rubber Duck agent enabled by default (v1.0.58): Check whether this adds unexpected turn overhead in automated runs.

1.0.60 → 1.0.61 (was #951)

• Auto-load MCP servers from .github/mcp.json (v1.0.61): ado-aw uses --additional-mcp-config; consider guarding against auto-loading interference.
• Claude Fable 5 model support (v1.0.61): Add to validated models in src/engine.rs/docs/engine.md.
• mTLS + private-CA for OTLP telemetry (v1.0.61): Added http/protobuf OTLP export via OTel env vars.
• Bug fix: grep/glob single-path fix (v1.0.61): Previously missed results with single path argument.
• Bug fix: shell validation false positives (v1.0.61): Fixed blocking of harmless commands with words like "kill" in string literals/heredocs.

1.0.60 → 1.0.62 (was #1002)

• Breaking: write_bash interactive input removed (v1.0.62): Shell commands now use lightweight process spawning; interactive input no longer supported. ado-aw exposes write_bash as a first-class tool — assess whether tool surface/docs need updating.
• Configure subagent model, reasoning effort, context tier (v1.0.62): Consider surfacing reasoning_effort/context-tier as front-matter fields.
• Kerberos/SPNEGO proxy auth (v1.0.62): Auto-auth through corporate forward proxies; relevant for enterprise ADO environments.

1.0.62 → 1.0.63 (was #1057)

• deferTools MCP server config option (v1.0.63): Keeps server tools available even when tool search is enabled. ado-aw could use this for safe-outputs and GitHub MCP servers to prevent them from being filtered out.

1.0.62 → 1.0.64 (was #1183)

• New OTel cache + reasoning token fields (v1.0.64): gen_ai.usage.cache_read.input_tokens, gen_ai.usage.cache_creation.input_tokens, gen_ai.usage.reasoning.output_tokens per GenAI semconv (old underscore-separated names gone). Update src/agent_stats.rs to parse new attribute names.
• Static OAuth client overrides for MCP server auth (v1.0.64): ado-aw could expose in MCP server config front-matter.
• Autopilot mode auto-handles ask_user, elicitation, sampling, permission prompts (v1.0.64): Reliability improvement for unattended pipeline runs.
• Deprecation: report_intent tool removed (v1.0.64): INTERNAL_TOOL_NAMES exclusion in src/agent_stats.rs containing "execute_tool report_intent" is now dead code; can be cleaned up.

1.0.64 → 1.0.67 (was #1272)

• Claude Sonnet 5 model support (v1.0.67): Add to src/engine.rs model allowlist + docs.
• Subagent sessions inherit parent tool restrictions (v1.0.67): Security-relevant behavior change; verify against expected security model.
• MCP OAuth against Microsoft Entra vanity domain servers (v1.0.67): Fixes AADSTS auth failures for Entra vanity domains; relevant for enterprise Azure AD MCP tools.
• copilot skill subcommand (v1.0.65): New /skill alias for listing/adding/removing skills; may be relevant for agency plugin scaffolding.
• Deprecation: Claude Opus 4.6 Fast → Claude Opus 4.8 Fast (v1.0.66): Update any ado-aw references to claude-opus-4.6-fast.

1.0.64 → 1.0.68 (was #1305) — canonical

• Breaking: session limits require minimum 30 AI credits (v1.0.67): Pipelines with session-limit: below 30 AI credits will be rejected at runtime. Review compiler defaults.
• Claude Opus 4.8 Fast model support (v1.0.66): Add claude-opus-4.8-fast to src/engine.rs allowlist.
• kimi-k2.7-code model support (v1.0.68): Add to model allowlist.

---

Consolidated by the Deps Release-Notes Consolidator workflow. Superseded per-release issues were closed and point here.

Generated by Deps Release-Notes Consolidator · 319.3 AIC · ⌖ 17.7 AIC · ⊞ 6.6K · ◷

[github-actions]

copilot-cli 1.0.64 → 1.0.69

Releases analyzed

• v1.0.65
• v1.0.66
• v1.0.67
• v1.0.68
• v1.0.69

Breaking changes

• Session limits now require a minimum of 30 AI credits (v1.0.67): Require session limits to be at least 30 AI credits — any pipeline using session-limit: with a value below 30 AI credits will be rejected at runtime. Review ado-aw's default session-limit values and add a compile-time validation warning if the configured limit is below 30.

Notable features for ado-aw to adopt

• Claude Sonnet 5 model support (v1.0.67): Add Claude Sonnet 5 as a supported model — add claude-sonnet-5 to src/engine.rs model allowlist and docs/engine.md.
• Claude Opus 4.8 Fast model support (v1.0.66): Add support for Claude Opus 4.8 Fast — add claude-opus-4.8-fast to ado-aw's model allowlist.
• kimi-k2.7-code model support (v1.0.68): Add support for the kimi-k2.7-code model — add kimi-k2.7-code to model allowlist.
• Minimal reasoning effort for gemini-3.5-flash (v1.0.69): Add minimal reasoning effort for gemini-3.5-flash — new minimal reasoning effort level for Gemini models; consider surfacing this in ado-aw's engine: front-matter reasoning-effort validation.
• copilot skill subcommand (v1.0.65): Add a copilot skill subcommand (and a /skill alias for /skills) — new subcommand for managing skills; relevant for the agency/plugins/ado-aw skill scaffolding and init --agency flow.
• web_fetch respects active sandbox network policy (v1.0.69): web_fetch now follows the active sandbox network policy (denying outbound or local targets the policy blocks) — security improvement: web_fetch calls from inside the AWF network sandbox now obey the AWF egress policy. No ado-aw changes needed; this is an automatic security improvement.
• Subagent sessions inherit parent tool restrictions (v1.0.67): Subagent sessions keep parent tool restrictions — tool restrictions set on the main agent propagate to spawned subagent sessions. Security-relevant behavior change; verify this aligns with ado-aw's expected security model for detection subagents.

Deprecations

• Claude Opus 4.6 Fast deprecated (v1.0.66): deprecate Claude Opus 4.6 Fast — superseded by claude-opus-4.8-fast. Update any ado-aw docs or model references to claude-opus-4.6-fast.

Generated by Dependency Version Updater · 180.6 AIC · ⌖ 14.4 AIC · ⊞ 10.9K · ◷

[github-actions]

copilot-cli 1.0.69 → 1.0.70

Releases analyzed

• v1.0.70

Notable features for ado-aw to adopt

• Plugin SHA pinning: plugins can now be pinned to an exact commit SHA via the sha field in plugin source configuration (v1.0.70). ado-aw's agency/plugins/ado-aw/ scaffolding and init --agency output could benefit from documenting or adopting this for reproducible installs.
• Repository-pinned model/effort/deny-lists: a trusted repository can now pin the model, effort level, and context tier, and extend URL/MCP/skill deny lists via .github/copilot/settings.json (v1.0.70). ado-aw's engine: front-matter config overlaps conceptually — worth tracking whether this should inform the compiled pipeline's model-selection logic or how it interacts with COPILOT_CLI_VERSION-pinned installs.
• GPT-5.6 model support (v1.0.70): new model available; ado-aw's engine model validation/allowlist in src/engine.rs may need updating to accept gpt-5.6 as a valid model identifier.
• preToolUse hooks exiting with code 2 deny tool calls (v1.0.70): new mechanism for blocking specific tool invocations at the hook layer. Could complement ado-aw's existing tool allow-listing in docs/tools.md.
• web_fetch works through mandatory HTTPS proxies (v1.0.70): relevant to AWF network-isolated environments where outbound traffic is proxied; may improve reliability of web_fetch calls within ado-aw pipelines.

Generated by Dependency Version Updater · 72.8 AIC · ⌖ 12.3 AIC · ⊞ 10.9K · ◷

[github-actions]

copilot-cli 1.0.70 → 1.0.71

Releases analyzed

• v1.0.71

Notable features for ado-aw to adopt

• Plan mode hard-blocks built-in mutating tool calls — when plan mode is active, the agent can no longer edit files or run mutating shell commands while planning; built-in mutators like opening a pull request are blocked (MCP and external tools are still allowed) (v1.0.71). ado-aw documentation around plan mode behavior should note this stricter enforcement.
• Lower default max sub-agent nesting depth from 6 to 4 — subagents.maxDepth default reduced to curb runaway recursive sub-agent delegation; usage-based billing users can still raise it up to 128 (v1.0.71). Agents that rely on deep sub-agent nesting may need their engine.args or agent prompts updated.
• plugins marketplace subcommands — new list, add, remove, browse, and update subcommands for managing plugin marketplaces (v1.0.71). The ado-aw init --agency scaffolding or the agency plugin docs may want to mention these.
• Persist GitHub MCP toolset/tool config via settings.json (githubMcpToolsets, githubMcpTools, etc.) (v1.0.71). ado-aw's GitHub MCP extension configuration surface may be affected.
• Sandbox filesystem policy enforced on LSP file reads and rename edits (v1.0.71). Agents that use LSP tooling in sandbox mode should verify their allowed-path configuration is correct.

Generated by Dependency Version Updater · 93.6 AIC · ⌖ 12.8 AIC · ⊞ 10.9K · ◷

[github-actions]

copilot-cli 1.0.70 → 1.0.73

Releases analyzed

• v1.0.71
• v1.0.72
• v1.0.73

Notable features for ado-aw to adopt

• Multi-turn subagents always enabled (v1.0.72): Multi-turn subagents are now always on — agents can receive follow-up messages from a running agent turn. ado-aw pipelines that launch subagents via the --allow-tool surface may benefit from this; no configuration change required but the behavior change is worth verifying in Stage 1 runs.
• Anthropic subagents continue working when additional directories are configured (v1.0.73): Fixed a regression where subagents backed by Anthropic models would stop working when extra directories were added to the agent context. ado-aw pipelines using Anthropic engines with workspace directory configuration benefit automatically.
• Relative links in custom agent instructions resolved from agent file location (v1.0.73): The CLI now resolves relative links inside agent instruction files relative to the agent file's own path. This is relevant to ado-aw's agent file layout — if any agent .md files use relative {{#runtime-import}} or similar relative references, those should now resolve correctly.

Bug fixes (no action needed, automatic)

• copilot -p --autopilot no longer hangs when a background shell or agent outlives the turn (v1.0.71): The CLI now correctly honors COPILOT_TASK_WAIT_TIMEOUT_SECONDS in autopilot mode. ado-aw Stage 1 timeout handling benefits automatically.

Generated by Dependency Version Updater · 100 AIC · ⌖ 12.9 AIC · ⊞ 10.9K · ◷

[github-actions]

copilot-cli 1.0.70 → 1.0.74

Releases analyzed

• v1.0.72
• v1.0.73
• v1.0.74

Security fixes

• copilot skill list strips terminal control characters from skill names/descriptions — a crafted skill could previously inject ANSI escape sequences into the listing output; this is now sanitized. Relevant to ado-aw's skill/plugin catalog listings if they surface copilot-cli output. (v1.0.72)

Notable features for ado-aw to adopt

• Open Plugin Spec v1 manifest support + mcp.json configuration — copilot-cli now supports Open Plugin Spec v1 plugin manifests and the mcp.json configuration convention. ado-aw's init --agency scaffolding and agency/plugins/ado-aw/ plugin layout could be updated to emit mcp.json and adopt the new spec format. (v1.0.74)
• gemini-3.6-flash model support added — ado-aw's engine model catalog and validation may need to accept gemini-3.6-flash as a valid model identifier. (v1.0.74)
• Multi-turn subagents always enabled — subagents can now receive follow-up messages without any opt-in. ado-aw's agent orchestration and Detection stage assumptions about subagent turn behavior may be worth reviewing. (v1.0.72)
• /model plan command for plan-mode model selection — plan mode now supports a dedicated model; ado-aw's engine configuration docs could call out plan model options. (v1.0.74)
• agentStop hook improvements (forced-continuation detection + 8-turn cap) — agentStop hooks that always block no longer loop indefinitely; hooks receive a stop_hook_active flag. ado-aw's compiled pipelines that configure agentStop hooks should review this behavioral change. (v1.0.72)

Generated by Dependency Version Updater · 108.7 AIC · ⌖ 13.4 AIC · ⊞ 11K · ◷

[github-actions]

copilot-cli 1.0.70 → 1.0.75

Releases analyzed

• v1.0.71
• v1.0.72
• v1.0.73
• v1.0.74
• v1.0.75

Notable features for ado-aw to adopt

• Claude Opus 5 model support (v1.0.75): Add support for Claude Opus 5 — ado-aw may want to document or add Claude Opus 5 as a supported model option in engine config/docs. See v1.0.75.
• Open Plugin Spec v1 / mcp.json support (v1.0.74): Add support for Open Plugin Spec v1 plugin manifests and mcp.json configuration — may affect how ado-aw's --additional-mcp-config wiring works or how plugin/skill manifests are authored. See v1.0.74.
• Plan mode now hard-blocks built-in mutating tool calls (v1.0.71): Plan mode now hard-blocks built-in tool calls that would modify the workspace — if ado-aw surfaces plan mode to users or documents it, this behavioral change should be noted. See v1.0.71.
• Multi-turn subagents always enabled (v1.0.72): Multi-turn subagents are always enabled, so you can send follow-up messages to running agents — could affect ado-aw's subagent configuration surface. See v1.0.72.
• Sandbox macOS keychain access now defaults off (v1.0.72): Sandbox macOS keychain access now defaults off for tighter isolation — sandboxing defaults have changed; review if ado-aw's AWF sandbox config needs alignment. See v1.0.72.
• Default sandbox opt-in splash / first-run (v1.0.74): Show a first-run splash to opt into the default sandbox — new interactive flow; verify ado-aw's non-interactive --no-ask-user pipeline usage is unaffected or adjust blocked-args. See v1.0.74.
• Max sub-agent nesting depth lowered from 6 to 4 (v1.0.71): Lower the default maximum sub-agent nesting depth from 6 to 4 — if ado-aw docs or templates rely on deep subagent nesting, they should be updated. See v1.0.71.

Deprecations

• copilot -p --autopilot hang fix (v1.0.71): The previous behaviour where copilot -p --autopilot could hang when a background shell or agent outlived the turn is now fixed; ado-aw pipeline invocations using --autopilot in non-interactive mode should now be reliable. See v1.0.71.

Generated by Dependency Version Updater · 75 AIC · ⌖ 12.1 AIC · ⊞ 11K · ◷

[github-actions]

copilot-cli 1.0.70 → 1.0.76

Releases analyzed

• v1.0.71 (notes unavailable in fetched list)
• v1.0.72 (notes unavailable in fetched list)
• v1.0.73
• v1.0.74
• v1.0.75
• v1.0.76

Notable features for ado-aw to adopt

• Enterprise sandbox floor enforcement: Enterprise administrators can now enforce a restrictive sandbox floor via managed settings that tighten (but never loosen) users' sandbox policies; the /sandbox dialog surfaces org-configured values with locked fields. ado-aw's documentation on sandbox configuration and enterprise policy may want to note this capability. (v1.0.76)
• Open Plugin Spec v1 support: Added support for Open Plugin Spec v1 plugin manifests and mcp.json configuration, enabling a standardized plugin authoring format that ado-aw's plugin tooling could leverage. (v1.0.74)
• New model support: Claude Opus 5 added in v1.0.75; grok-4.5 and gemini-3.6-flash added in v1.0.74/v1.0.76. ado-aw's engine model catalog (docs/engine.md) may need updating to reflect these new options.
• web_fetch sandbox policy fix: web_fetch now correctly denies egress when network.allowOutbound is false and a proxy is configured — a proxy no longer silently overrides the user's outbound sandbox policy. Relevant for ado-aw pipelines that configure outbound network restrictions. (v1.0.76)

Generated by Dependency Version Updater · 103.7 AIC · ⌖ 13.7 AIC · ⊞ 11.1K · ◷

[github-actions]

copilot-cli 1.0.70 → 1.0.77

Releases analyzed

• v1.0.71
• v1.0.72
• v1.0.73
• v1.0.74
• v1.0.75
• v1.0.76
• v1.0.77

Breaking changes

• v1.0.71: Default max sub-agent nesting depth lowered from 6 to 4. ado-aw agents with deep recursive sub-agent chains may behave differently; subagents.maxDepth can be raised up to 128 if needed. (v1.0.71)
• v1.0.71: Plan mode now hard-blocks built-in tool calls that would modify the workspace — agents can no longer edit files or run mutating shell commands while planning. This is a behaviour change for any ado-aw workflow that relies on plan mode + file edits in the same step. (v1.0.71)
• v1.0.72: macOS sandbox keychain access now defaults to off for tighter isolation. Agents that previously relied on keychain access will need it explicitly re-enabled. (Likely low impact for ado-aw which runs on Linux ADO agents, but worth noting.) (v1.0.72)

Security fixes

• v1.0.72: copilot skill list now strips terminal control characters from skill names/descriptions, preventing a crafted skill from injecting ANSI escape sequences into CLI output. (v1.0.72)
• v1.0.76: URL permission prompts now always surface the sandbox-bypass warning and the model's reason when a host integration rebuilds the prompt — an elevated fetch can no longer be displayed as an ordinary one. (v1.0.76)
• v1.0.76: web_fetch now routes through the configured sandbox proxy and denies egress when network.allowOutbound is false — a proxy can no longer override the user's outbound policy. (v1.0.76)
• v1.0.77: "Unconditional autopilot approval now disables sandbox for the current session when bypass is allowed" — sandbox bypass semantics clarified; ado-aw workflows using autopilot mode should verify this matches intended isolation posture. (v1.0.77)
• v1.0.77: Enterprise administrators can now enforce managed sandbox policy via macOS and Windows native MDM settings. (v1.0.77)

Notable features for ado-aw to adopt

• v1.0.74: Open Plugin Spec v1 plugin manifests and mcp.json configuration are now supported. ado-aw's mcp-author plugin scaffold and init --agency templates could be updated to emit OPS-v1-compatible manifests. (v1.0.74)
• v1.0.75: Claude Opus 5 is now supported. ado-aw's engine: model documentation and catalog should list it as an available model. (v1.0.75)
• v1.0.76: grok-4.5 model is now supported. ado-aw's model catalog should be updated. (v1.0.76)
• v1.0.77: Reasoning effort can now be omitted so the server selects the default. ado-aw's engine.reasoning-effort front-matter field documentation should note this is now optional (server default applies when omitted). (v1.0.77)

Generated by Dependency Version Updater · 98 AIC · ⌖ 12.7 AIC · ⊞ 11.1K · ◷

[github-actions]

copilot-cli 1.0.70 → 1.0.78

Releases analyzed

• v1.0.71
• v1.0.72
• v1.0.73
• v1.0.74
• v1.0.75
• v1.0.76
• v1.0.77
• v1.0.78

Breaking changes

• Plan mode now hard-blocks built-in tool calls that would modify the workspace (v1.0.71): the agent can no longer edit files or run mutating shell commands while planning (built-in mutators like opening a pull request are blocked; MCP/external tools still allowed). Relevant if any ado-aw prompt flow relies on plan-mode side effects.
• sessionEnd hook semantics changed for piped/stdin prompts (v1.0.78): a run whose prompt is piped over stdin now fires sessionEnd once per completed agent turn with reason: complete/error, instead of once at shutdown with user_exit. ado-aw pipes prompts to the CLI non-interactively — if any tooling depends on the old single-shutdown-hook behavior, it needs updating.
• Managed-settings fetch failure now fails open, not closed (v1.0.78): when a server-managed settings fetch fails (network error, non-2xx, malformed response) and no cached policy is usable, the CLI now starts without the unconfirmed server restriction rather than refusing to start. Worth confirming this doesn't weaken any managed-settings assumptions ado-aw relies on for sandboxed pipeline runs.

Security fixes

• copilot skill list strips terminal control characters (v1.0.72): a crafted skill name/description can no longer inject ANSI escape sequences into listing output — relevant since ado-aw scaffolds skills via init/agency plugin.
• Hook output now bounded at 10 MiB per invocation (v1.0.76): part of a broader hardening of userPromptSubmitted hook handling (invalid non-string modifiedPrompt/responseContent values are now ignored with a warning instead of corrupting the session; null additionalContext treated as absent) — prevents an HTTP/command hook from exhausting memory.
• Sandbox filesystem policy now enforced on LSP file reads and rename edits (v1.0.71).
• Sandbox denied paths enforced for relative and symlinked entries on macOS/Linux (v1.0.76) — closes a path-traversal-style gap in the sandbox denylist (Windows cannot deny per path).

Notable features for ado-aw to adopt

• Grok-4.5, Claude Opus 5, gemini-3.6-flash model support (v1.0.74, v1.0.75, v1.0.76): consider adding to the model allowlist in src/engine.rs/docs/engine.md.
• Open Plugin Spec v1 plugin manifests and mcp.json configuration support (v1.0.74): relevant to the agency plugin (agency/plugins/ado-aw/) which already wires an .mcp.json.
• New sandbox setting allowDevToolCaches (v1.0.78, on by default): grants sandboxed builds access to toolchain caches/registries/installs. Worth checking interplay with AWF's own network-isolation model for ado-aw's runtimes (Python/Node/.NET/Lean).
• web_fetch respects network.allowOutbound and routes through the configured sandbox proxy (v1.0.76): may be relevant to how ado-aw documents/expects outbound network behavior inside the AWF sandbox.
• Opt-in git and gh authentication inside the OS sandbox (v1.0.72).
• /permissions command to switch approval modes; the /allow-all auto safety-judge model is no longer user-configurable (v1.0.78) — the judge model selection is now automatic, which may affect any documentation referencing bypass/allow-all behavior.
• Enterprise-enforced restrictive sandbox floor via managed settings (v1.0.76): managed settings can tighten (never loosen) the sandbox policy — relevant to docs/network.md's AWF sandbox model discussion.

Deprecations

• None called out explicitly in this range; the /allow-all judge-model configurability removal (v1.0.78, noted above) is effectively a deprecation of that user-facing knob.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · aut00 · 89.7 AIC · ⌖ 12.5 AIC · ⊞ 16.1K · ◷

[github-actions]

copilot-cli 1.0.70 → 1.0.78

Releases analyzed

• v1.0.78

Notable features for ado-aw to adopt

• Tool-call duration timeline headers — the CLI now surfaces per-tool-call timing in its output headers. ado-aw's engine invocation / OTel agent-stats parsing (src/agent_stats.rs) could potentially surface this for richer audit/trace reporting (ado-aw audit, ado-aw trace).
• Plugin auto-update at session start — the CLI now checks and applies plugin updates automatically when a session starts. Worth confirming this doesn't introduce unexpected network calls inside AWF's network-isolated sandbox during the Agent stage; if plugin auto-update requires network access, it may need an AWF allowlist entry or an explicit disable flag in ado-aw's engine: invocation.
• /new-worktree experimental command — new git-worktree-based session isolation command. Not directly relevant to ado-aw's non-interactive pipeline usage today, but worth tracking if worktree isolation becomes useful for multi-branch agent runs.
• ACP token usage exposure — Agent Communication Protocol now exposes token usage data. Could be surfaced in ado-aw audit's OTel/token-usage reporting.
• forceRemoteSettingsRefresh managed setting — new managed setting to force a refresh of remote settings. May be relevant to how ado-aw configures engine.args/engine.env for managed/enterprise deployments.

Deprecations / behavior changes worth flagging

• Browser-flow login default change for local/no-TTY sessions — the default authentication flow changed for sessions without a TTY. ado-aw's compiled pipelines run the Copilot CLI non-interactively inside ADO agents (no TTY), so this default change could affect how auth is established in the Agent job; worth verifying the current github-app-token/token-passthrough mechanism (scripts/ado-script/src/github-app-token/) is unaffected.
• sessionEnd hook firing semantics change for piped stdin runs — the conditions under which the sessionEnd hook fires changed when input is piped via stdin, which is how ado-aw feeds prompts to the engine. Worth double-checking that any hook-dependent cleanup/telemetry in the Agent job still fires as expected.
• Sandbox bypass scoping narrowed to session-only and managed-settings fail-open fallback behavior — both relate to sandboxing/managed-settings enforcement. Worth confirming these don't change how engine: invokes the CLI inside the AWF sandbox in ado-aw's Agent stage.

No CVE/security-advisory-labeled fixes were called out explicitly in this release's notes; no items in this range were classified as hard breaking changes, though several of the above behavior changes are worth a deliberate compatibility check on the next COPILOT_CLI_VERSION bump PR.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · aut00 · 131.4 AIC · ⌖ 12.9 AIC · ⊞ 16.1K · ◷

[github-actions]

copilot-cli 1.0.70 → 1.0.79

Releases analyzed

• v1.0.71
• v1.0.72
• v1.0.73
• v1.0.76
• v1.0.77
• v1.0.78
• v1.0.79

Breaking changes

• Sandbox auth settings key rename, no migration (v1.0.79): sandbox.gitAuth/sandbox.ghAuth moved to sandbox.auth.git/sandbox.auth.gh. Old keys are silently ignored in settings files, and SDK requests still sending them are now rejected as invalid rather than ignored. Any ado-aw docs/tooling referencing the old keys should be updated.
• --worktree default start ref changed (v1.0.79): the new worktreeBaseRef setting controls whether /worktree, /worktree new, and --worktree start from HEAD or the remote default branch; all three now default to HEAD (previously --worktree defaulted to the remote default branch).

Security fixes

• Opt-in git/gh auth inside the OS sandbox; macOS keychain access now defaults off (v1.0.72): tightens default sandbox isolation — re-enabling requires explicit /sandbox opt-in.
• Plan mode hard-blocks mutating built-in tool calls (v1.0.71): the agent can no longer edit files or run mutating shell commands while planning; relevant to ado-aw's sandboxed agent execution model.

Notable features for ado-aw to adopt

• tgrep replaces ripgrep for large monorepos (v1.0.79): trigram-indexed search for faster regex search in large codebases — transparent to ado-aw but worth noting for perf-sensitive agent runs.
• Tool-call duration timeline headers (v1.0.78): per-tool-call timing surfaced in CLI output (/settings showToolDurations); could be useful context for ado-aw audit/agent stats parsing if surfaced in structured output.
• grok-4.5 model support (v1.0.76): new model available; consider adding to any ado-aw model allowlist/docs.
• Browser-based (web) OAuth login flow, now default on local interactive terminals (v1.0.77): --web-flow/--device-code flags select the mode explicitly; remote/headless environments (matching ado-aw's sandboxed pipeline runs) continue to default to device code, so no expected impact on compiled pipelines, but worth confirming.

Deprecations

• None called out in this release range.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 97 AIC · ⌖ 16.4 AIC · ⊞ 16.2K · ◷