Skip to content

Bump the npm_and_yarn group across 2 directories with 4 updates - #1

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/test/harness/npm_and_yarn-1c51713eb8
Closed

Bump the npm_and_yarn group across 2 directories with 4 updates#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/test/harness/npm_and_yarn-1c51713eb8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 7, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 2 updates in the /test/harness directory: @github/copilot and rollup.
Bumps the npm_and_yarn group with 4 updates in the /nodejs directory: @github/copilot, rollup, minimatch and lodash.

Updates @github/copilot from 0.0.394 to 0.0.423

Release notes

Sourced from @​github/copilot's releases.

0.0.423

2026-03-06

  • Users are prompted for shell commands with potentially dangerous expansion or substitution use cases, additional guardrails for malicious exploits
  • Block /share gist for EMU and GHE Cloud users with clear error messaging
  • Elicitation enum and boolean fields now require Enter to confirm a selection, with a ✓ indicator for confirmed values vs ❯ for the browsing cursor
  • MCP servers can now request users to visit a URL for out-of-band interactions such as OAuth flows or API key entry
  • Improve explore agent precision and large repository support with better context sharing
  • Diff mode displays cleanly on Windows with CRLF line endings

0.0.422

2026-03-05

  • Display request ID in authentication and authorization error messages to aid troubleshooting
  • Load personal hooks from ~/.copilot/hooks in addition to repo-level .github/hooks
  • Timeline now shows the question in a box and displays 'Making best guess on autopilot' when ask_user is auto-responded
  • Add support for GPT-5.4 model
  • Plugin cache automatically recovers from a corrupted or incomplete clone without manual intervention
  • Show a clear, actionable error message when git is not installed and a remote plugin or marketplace is used
  • Text selection persists after copying to clipboard in alt screen
  • Scroll view no longer jumps to earlier messages when scrolling during response streaming or with popups open
  • Add copy_on_select config option to auto-copy selected text to clipboard in alt screen mode
  • IME candidate windows appear at correct cursor position in CJK input
  • Add mouse scroll support to /diff in alt-screen mode
  • Reduce memory usage in alt-screen mode for long sessions
  • Diff mode now works correctly when git color.diff=always is configured
  • Opening links on Windows correctly handles URLs with & query parameters
  • @-mention file completion always reflects the current state of the working directory
  • ESC key to cancel works correctly in tmux and other non-kitty terminals
  • Click in the prompt input to reposition the text cursor
  • Add /copy command to copy the last response to clipboard
  • Links in alt-screen mode are rendered with underline styling for better visibility
  • /delegate prompts for a target remote in multi-remote repositories and clarifies confirmation text
  • GitHub MCP server stays enabled in repositories that have both Azure DevOps and GitHub remotes
  • Colons in inline code render correctly inside markdown tables
  • Pressing Ctrl+C on the help dialog now dismisses it cleanly
  • Plugin-contributed LSP servers are now loaded, started, and shown in /lsp show
  • Pressing Enter in required enum field now selects the highlighted option
  • Hide noisy todo bookkeeping queries and show dependency details in timeline
  • CLI no longer hangs for minutes when working in a directory with a large number of files
  • Add --output-format json flag to emit JSONL in prompt mode for programmatic integrations
  • Add exitPlanMode.request protocol method for SDK plan approval support
  • Automatic notifications when background shell commands and agents complete
  • GitHub MCP server connection status is accurately tracked and counted in the status indicator
  • Press Ctrl+R to search command history with reverse incremental search (like Bash)
  • Long diff lines no longer overflow and wrap in the diff view
  • Add startup prompt hooks to auto-submit prompts or slash commands when a session starts
  • Ctrl+K joins lines when cursor is at end of line, matching standard Emacs/terminal behavior
  • Escape sequences split across input chunks no longer leak into text input
  • Rename launch_messages config setting to companyAnnouncements

... (truncated)

Changelog

Sourced from @​github/copilot's changelog.

0.0.423 - 2026-03-06

  • Users are prompted for shell commands with potentially dangerous expansion or substitution use cases, additional guardrails for malicious exploits
  • Block /share gist for EMU and GHE Cloud users with clear error messaging
  • Elicitation enum and boolean fields now require Enter to confirm a selection, with a ✓ indicator for confirmed values vs ❯ for the browsing cursor
  • MCP servers can now request users to visit a URL for out-of-band interactions such as OAuth flows or API key entry
  • Improve explore agent precision and large repository support with better context sharing
  • Diff mode displays cleanly on Windows with CRLF line endings

0.0.422 - 2026-03-05

  • Display request ID in authentication and authorization error messages to aid troubleshooting
  • Load personal hooks from ~/.copilot/hooks in addition to repo-level .github/hooks
  • Timeline now shows the question in a box and displays 'Making best guess on autopilot' when ask_user is auto-responded
  • Add support for GPT-5.4 model
  • Plugin cache automatically recovers from a corrupted or incomplete clone without manual intervention
  • Show a clear, actionable error message when git is not installed and a remote plugin or marketplace is used
  • Text selection persists after copying to clipboard in alt screen
  • Scroll view no longer jumps to earlier messages when scrolling during response streaming or with popups open
  • Add copy_on_select config option to auto-copy selected text to clipboard in alt screen mode
  • IME candidate windows appear at correct cursor position in CJK input
  • Add mouse scroll support to /diff in alt-screen mode
  • Reduce memory usage in alt-screen mode for long sessions
  • Diff mode now works correctly when git color.diff=always is configured
  • Opening links on Windows correctly handles URLs with & query parameters
  • @-mention file completion always reflects the current state of the working directory
  • ESC key to cancel works correctly in tmux and other non-kitty terminals
  • Click in the prompt input to reposition the text cursor
  • Add /copy command to copy the last response to clipboard
  • Links in alt-screen mode are rendered with underline styling for better visibility
  • /delegate prompts for a target remote in multi-remote repositories and clarifies confirmation text
  • GitHub MCP server stays enabled in repositories that have both Azure DevOps and GitHub remotes
  • Colons in inline code render correctly inside markdown tables
  • Pressing Ctrl+C on the help dialog now dismisses it cleanly
  • Plugin-contributed LSP servers are now loaded, started, and shown in /lsp show
  • Pressing Enter in required enum field now selects the highlighted option
  • Hide noisy todo bookkeeping queries and show dependency details in timeline
  • CLI no longer hangs for minutes when working in a directory with a large number of files
  • Add --output-format json flag to emit JSONL in prompt mode for programmatic integrations
  • Add exitPlanMode.request protocol method for SDK plan approval support
  • Automatic notifications when background shell commands and agents complete
  • GitHub MCP server connection status is accurately tracked and counted in the status indicator
  • Press Ctrl+R to search command history with reverse incremental search (like Bash)
  • Long diff lines no longer overflow and wrap in the diff view
  • Add startup prompt hooks to auto-submit prompts or slash commands when a session starts
  • Ctrl+K joins lines when cursor is at end of line, matching standard Emacs/terminal behavior
  • Escape sequences split across input chunks no longer leak into text input
  • Rename launch_messages config setting to companyAnnouncements
  • Show a waiting message when the terminal is handed to an external editor
  • Support enabledPlugins in config for automatic plugin installation at startup

... (truncated)

Commits
  • 7aa08b3 Update changelog.md for version 0.0.422
  • 689d148 Update changelog.md for version 0.0.421
  • 119c6f8 Merge pull request #1699 from github/devm33/install-ready
  • 3b73154 Update changelog.md for version 0.0.420
  • 9596516 Update changelog.md for version 0.0.419
  • 30034c7 install: guide user to update PATH for current shell session
  • 9277ab5 Update changelog.md for version 0.0.418
  • f8396ae Merge pull request #1670 from github/RyanHecht-patch-1
  • b54e97c Update README.md
  • aea9faa Revise README for GitHub Copilot CLI installation
  • Additional commits viewable in compare view

Updates rollup from 4.54.0 to 4.59.0

Release notes

Sourced from rollup's releases.

v4.59.0

4.59.0

2026-02-22

Features

  • Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

v4.58.0

4.58.0

2026-02-20

Features

  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#6272)

Pull Requests

v4.57.1

4.57.1

2026-01-30

Bug Fixes

  • Fix heap corruption issue in Windows (#6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#6254)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.59.0

2026-02-22

Features

  • Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

4.58.0

2026-02-20

Features

  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#6272)

Pull Requests

4.57.1

2026-01-30

Bug Fixes

  • Fix heap corruption issue in Windows (#6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#6254)

Pull Requests

... (truncated)

Commits

Updates @github/copilot from 0.0.394 to 0.0.423

Release notes

Sourced from @​github/copilot's releases.

0.0.423

2026-03-06

  • Users are prompted for shell commands with potentially dangerous expansion or substitution use cases, additional guardrails for malicious exploits
  • Block /share gist for EMU and GHE Cloud users with clear error messaging
  • Elicitation enum and boolean fields now require Enter to confirm a selection, with a ✓ indicator for confirmed values vs ❯ for the browsing cursor
  • MCP servers can now request users to visit a URL for out-of-band interactions such as OAuth flows or API key entry
  • Improve explore agent precision and large repository support with better context sharing
  • Diff mode displays cleanly on Windows with CRLF line endings

0.0.422

2026-03-05

  • Display request ID in authentication and authorization error messages to aid troubleshooting
  • Load personal hooks from ~/.copilot/hooks in addition to repo-level .github/hooks
  • Timeline now shows the question in a box and displays 'Making best guess on autopilot' when ask_user is auto-responded
  • Add support for GPT-5.4 model
  • Plugin cache automatically recovers from a corrupted or incomplete clone without manual intervention
  • Show a clear, actionable error message when git is not installed and a remote plugin or marketplace is used
  • Text selection persists after copying to clipboard in alt screen
  • Scroll view no longer jumps to earlier messages when scrolling during response streaming or with popups open
  • Add copy_on_select config option to auto-copy selected text to clipboard in alt screen mode
  • IME candidate windows appear at correct cursor position in CJK input
  • Add mouse scroll support to /diff in alt-screen mode
  • Reduce memory usage in alt-screen mode for long sessions
  • Diff mode now works correctly when git color.diff=always is configured
  • Opening links on Windows correctly handles URLs with & query parameters
  • @-mention file completion always reflects the current state of the working directory
  • ESC key to cancel works correctly in tmux and other non-kitty terminals
  • Click in the prompt input to reposition the text cursor
  • Add /copy command to copy the last response to clipboard
  • Links in alt-screen mode are rendered with underline styling for better visibility
  • /delegate prompts for a target remote in multi-remote repositories and clarifies confirmation text
  • GitHub MCP server stays enabled in repositories that have both Azure DevOps and GitHub remotes
  • Colons in inline code render correctly inside markdown tables
  • Pressing Ctrl+C on the help dialog now dismisses it cleanly
  • Plugin-contributed LSP servers are now loaded, started, and shown in /lsp show
  • Pressing Enter in required enum field now selects the highlighted option
  • Hide noisy todo bookkeeping queries and show dependency details in timeline
  • CLI no longer hangs for minutes when working in a directory with a large number of files
  • Add --output-format json flag to emit JSONL in prompt mode for programmatic integrations
  • Add exitPlanMode.request protocol method for SDK plan approval support
  • Automatic notifications when background shell commands and agents complete
  • GitHub MCP server connection status is accurately tracked and counted in the status indicator
  • Press Ctrl+R to search command history with reverse incremental search (like Bash)
  • Long diff lines no longer overflow and wrap in the diff view
  • Add startup prompt hooks to auto-submit prompts or slash commands when a session starts
  • Ctrl+K joins lines when cursor is at end of line, matching standard Emacs/terminal behavior
  • Escape sequences split across input chunks no longer leak into text input
  • Rename launch_messages config setting to companyAnnouncements

... (truncated)

Changelog

Sourced from @​github/copilot's changelog.

0.0.423 - 2026-03-06

  • Users are prompted for shell commands with potentially dangerous expansion or substitution use cases, additional guardrails for malicious exploits
  • Block /share gist for EMU and GHE Cloud users with clear error messaging
  • Elicitation enum and boolean fields now require Enter to confirm a selection, with a ✓ indicator for confirmed values vs ❯ for the browsing cursor
  • MCP servers can now request users to visit a URL for out-of-band interactions such as OAuth flows or API key entry
  • Improve explore agent precision and large repository support with better context sharing
  • Diff mode displays cleanly on Windows with CRLF line endings

0.0.422 - 2026-03-05

  • Display request ID in authentication and authorization error messages to aid troubleshooting
  • Load personal hooks from ~/.copilot/hooks in addition to repo-level .github/hooks
  • Timeline now shows the question in a box and displays 'Making best guess on autopilot' when ask_user is auto-responded
  • Add support for GPT-5.4 model
  • Plugin cache automatically recovers from a corrupted or incomplete clone without manual intervention
  • Show a clear, actionable error message when git is not installed and a remote plugin or marketplace is used
  • Text selection persists after copying to clipboard in alt screen
  • Scroll view no longer jumps to earlier messages when scrolling during response streaming or with popups open
  • Add copy_on_select config option to auto-copy selected text to clipboard in alt screen mode
  • IME candidate windows appear at correct cursor position in CJK input
  • Add mouse scroll support to /diff in alt-screen mode
  • Reduce memory usage in alt-screen mode for long sessions
  • Diff mode now works correctly when git color.diff=always is configured
  • Opening links on Windows correctly handles URLs with & query parameters
  • @-mention file completion always reflects the current state of the working directory
  • ESC key to cancel works correctly in tmux and other non-kitty terminals
  • Click in the prompt input to reposition the text cursor
  • Add /copy command to copy the last response to clipboard
  • Links in alt-screen mode are rendered with underline styling for better visibility
  • /delegate prompts for a target remote in multi-remote repositories and clarifies confirmation text
  • GitHub MCP server stays enabled in repositories that have both Azure DevOps and GitHub remotes
  • Colons in inline code render correctly inside markdown tables
  • Pressing Ctrl+C on the help dialog now dismisses it cleanly
  • Plugin-contributed LSP servers are now loaded, started, and shown in /lsp show
  • Pressing Enter in required enum field now selects the highlighted option
  • Hide noisy todo bookkeeping queries and show dependency details in timeline
  • CLI no longer hangs for minutes when working in a directory with a large number of files
  • Add --output-format json flag to emit JSONL in prompt mode for programmatic integrations
  • Add exitPlanMode.request protocol method for SDK plan approval support
  • Automatic notifications when background shell commands and agents complete
  • GitHub MCP server connection status is accurately tracked and counted in the status indicator
  • Press Ctrl+R to search command history with reverse incremental search (like Bash)
  • Long diff lines no longer overflow and wrap in the diff view
  • Add startup prompt hooks to auto-submit prompts or slash commands when a session starts
  • Ctrl+K joins lines when cursor is at end of line, matching standard Emacs/terminal behavior
  • Escape sequences split across input chunks no longer leak into text input
  • Rename launch_messages config setting to companyAnnouncements
  • Show a waiting message when the terminal is handed to an external editor
  • Support enabledPlugins in config for automatic plugin installation at startup

... (truncated)

Commits
  • 7aa08b3 Update changelog.md for version 0.0.422
  • 689d148 Update changelog.md for version 0.0.421
  • 119c6f8 Merge pull request #1699 from github/devm33/install-ready
  • 3b73154 Update changelog.md for version 0.0.420
  • 9596516 Update changelog.md for version 0.0.419
  • 30034c7 install: guide user to update PATH for current shell session
  • 9277ab5 Update changelog.md for version 0.0.418
  • f8396ae Merge pull request #1670 from github/RyanHecht-patch-1
  • b54e97c Update README.md
  • aea9faa Revise README for GitHub Copilot CLI installation
  • Additional commits viewable in compare view

Updates rollup from 4.53.5 to 4.59.0

Release notes

Sourced from rollup's releases.

v4.59.0

4.59.0

2026-02-22

Features

  • Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

v4.58.0

4.58.0

2026-02-20

Features

  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#6272)

Pull Requests

v4.57.1

4.57.1

2026-01-30

Bug Fixes

  • Fix heap corruption issue in Windows (#6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#6254)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.59.0

2026-02-22

Features

  • Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

4.58.0

2026-02-20

Features

  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#6272)

Pull Requests

4.57.1

2026-01-30

Bug Fixes

  • Fix heap corruption issue in Windows (#6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#6254)

Pull Requests

... (truncated)

Commits

Updates minimatch from 3.1.2 to 3.1.5

Commits

Updates lodash from 4.17.21 to 4.17.23

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 2 directories with 4 updates
a60f4cf 
Bumps the npm_and_yarn group with 2 updates in the /test/harness directory: [@github/copilot](https://github.com/github/copilot-cli) and [rollup](https://github.com/rollup/rollup).
Bumps the npm_and_yarn group with 4 updates in the /nodejs directory: [@github/copilot](https://github.com/github/copilot-cli), [rollup](https://github.com/rollup/rollup), [minimatch](https://github.com/isaacs/minimatch) and [lodash](https://github.com/lodash/lodash).


Updates `@github/copilot` from 0.0.394 to 0.0.423
- [Release notes](https://github.com/github/copilot-cli/releases)
- [Changelog](https://github.com/github/copilot-cli/blob/main/changelog.md)
- [Commits](github/copilot-cli@v0.0.394...v0.0.423)

Updates `rollup` from 4.54.0 to 4.59.0
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.54.0...v4.59.0)

Updates `@github/copilot` from 0.0.394 to 0.0.423
- [Release notes](https://github.com/github/copilot-cli/releases)
- [Changelog](https://github.com/github/copilot-cli/blob/main/changelog.md)
- [Commits](github/copilot-cli@v0.0.394...v0.0.423)

Updates `rollup` from 4.53.5 to 4.59.0
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.54.0...v4.59.0)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

---
updated-dependencies:
- dependency-name: "@github/copilot"
  dependency-version: 0.0.423
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.59.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@github/copilot"
  dependency-version: 0.0.423
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.59.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 7, 2026
@dependabot @github

dependabot Bot commented on behalf of github Apr 6, 2026

Copy link
Copy Markdown
Author

Superseded by #2.

@dependabot dependabot Bot closed this Apr 6, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/test/harness/npm_and_yarn-1c51713eb8 branch April 6, 2026 21:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants