build(deps): bump @github/copilot and @github/copilot-sdk in /tests

[dependabot]

Bumps @github/copilot to 1.0.2 and updates ancestor dependency @github/copilot-sdk. These dependencies need to be updated together.

Updates @github/copilot from 0.0.414 to 1.0.2

Release notes

Sourced from @​github/copilot's releases.

1.0.2

2026-03-06

To commemorate GitHub Copilot CLI reaching general availability last week, we're incrementing the major version to 1.0!

• Type 'exit' as a bare command to close the CLI
• Ask_user form now submits with Enter key and allows custom responses in enum fields
• Support 'command' field as cross-platform alias for bash/powershell in hook configs
• Hook configurations now accept timeout as alias for timeoutSec
• Fix handling of meta with control keys (including shift+enter from /terminal-setup)

0.0.423

2026-03-06

• Users are prompted for shell commands with potentially dangerous expansion or substitution use cases, additional guardrails for malicious exploits
• Block /share gist for EMU and GHE Cloud users with clear error messaging
• Elicitation enum and boolean fields now require Enter to confirm a selection, with a ✓ indicator for confirmed values vs ❯ for the browsing cursor
• MCP servers can now request users to visit a URL for out-of-band interactions such as OAuth flows or API key entry
• Improve explore agent precision and large repository support with better context sharing
• Diff mode displays cleanly on Windows with CRLF line endings

0.0.422

2026-03-05

• Display request ID in authentication and authorization error messages to aid troubleshooting
• Load personal hooks from ~/.copilot/hooks in addition to repo-level .github/hooks
• Timeline now shows the question in a box and displays 'Making best guess on autopilot' when ask_user is auto-responded
• Add support for GPT-5.4 model
• Plugin cache automatically recovers from a corrupted or incomplete clone without manual intervention
• Show a clear, actionable error message when git is not installed and a remote plugin or marketplace is used
• Text selection persists after copying to clipboard in alt screen
• Scroll view no longer jumps to earlier messages when scrolling during response streaming or with popups open
• Add copy_on_select config option to auto-copy selected text to clipboard in alt screen mode
• IME candidate windows appear at correct cursor position in CJK input
• Add mouse scroll support to /diff in alt-screen mode
• Reduce memory usage in alt-screen mode for long sessions
• Diff mode now works correctly when git color.diff=always is configured
• Opening links on Windows correctly handles URLs with & query parameters
• @-mention file completion always reflects the current state of the working directory
• ESC key to cancel works correctly in tmux and other non-kitty terminals
• Click in the prompt input to reposition the text cursor
• Add /copy command to copy the last response to clipboard
• Links in alt-screen mode are rendered with underline styling for better visibility
• /delegate prompts for a target remote in multi-remote repositories and clarifies confirmation text
• GitHub MCP server stays enabled in repositories that have both Azure DevOps and GitHub remotes
• Colons in inline code render correctly inside markdown tables
• Pressing Ctrl+C on the help dialog now dismisses it cleanly
• Plugin-contributed LSP servers are now loaded, started, and shown in /lsp show
• Pressing Enter in required enum field now selects the highlighted option
• Hide noisy todo bookkeeping queries and show dependency details in timeline

... (truncated)

Changelog

Sourced from @​github/copilot's changelog.

1.0.2 - 2026-03-06

To commemorate GitHub Copilot CLI reaching general availability last week, we're incrementing the major version to 1.0!

• Type 'exit' as a bare command to close the CLI
• Ask_user form now submits with Enter key and allows custom responses in enum fields
• Support 'command' field as cross-platform alias for bash/powershell in hook configs
• Hook configurations now accept timeout as alias for timeoutSec
• Fix handling of meta with control keys (including shift+enter from /terminal-setup)

0.0.423 - 2026-03-06

• Users are prompted for shell commands with potentially dangerous expansion or substitution use cases, additional guardrails for malicious exploits
• Block /share gist for EMU and GHE Cloud users with clear error messaging
• Elicitation enum and boolean fields now require Enter to confirm a selection, with a ✓ indicator for confirmed values vs ❯ for the browsing cursor
• MCP servers can now request users to visit a URL for out-of-band interactions such as OAuth flows or API key entry
• Improve explore agent precision and large repository support with better context sharing
• Diff mode displays cleanly on Windows with CRLF line endings

0.0.422 - 2026-03-05

• Display request ID in authentication and authorization error messages to aid troubleshooting
• Load personal hooks from ~/.copilot/hooks in addition to repo-level .github/hooks
• Timeline now shows the question in a box and displays 'Making best guess on autopilot' when ask_user is auto-responded
• Add support for GPT-5.4 model
• Plugin cache automatically recovers from a corrupted or incomplete clone without manual intervention
• Show a clear, actionable error message when git is not installed and a remote plugin or marketplace is used
• Text selection persists after copying to clipboard in alt screen
• Scroll view no longer jumps to earlier messages when scrolling during response streaming or with popups open
• Add copy_on_select config option to auto-copy selected text to clipboard in alt screen mode
• IME candidate windows appear at correct cursor position in CJK input
• Add mouse scroll support to /diff in alt-screen mode
• Reduce memory usage in alt-screen mode for long sessions
• Diff mode now works correctly when git color.diff=always is configured
• Opening links on Windows correctly handles URLs with & query parameters
• @-mention file completion always reflects the current state of the working directory
• ESC key to cancel works correctly in tmux and other non-kitty terminals
• Click in the prompt input to reposition the text cursor
• Add /copy command to copy the last response to clipboard
• Links in alt-screen mode are rendered with underline styling for better visibility
• /delegate prompts for a target remote in multi-remote repositories and clarifies confirmation text
• GitHub MCP server stays enabled in repositories that have both Azure DevOps and GitHub remotes
• Colons in inline code render correctly inside markdown tables
• Pressing Ctrl+C on the help dialog now dismisses it cleanly
• Plugin-contributed LSP servers are now loaded, started, and shown in /lsp show
• Pressing Enter in required enum field now selects the highlighted option
• Hide noisy todo bookkeeping queries and show dependency details in timeline
• CLI no longer hangs for minutes when working in a directory with a large number of files
• Add --output-format json flag to emit JSONL in prompt mode for programmatic integrations
• Add exitPlanMode.request protocol method for SDK plan approval support

... (truncated)

Commits

• 732d8b1 Update changelog.md for version 0.0.423
• 7aa08b3 Update changelog.md for version 0.0.422
• 689d148 Update changelog.md for version 0.0.421
• 119c6f8 Merge pull request #1699 from github/devm33/install-ready
• 3b73154 Update changelog.md for version 0.0.420
• 9596516 Update changelog.md for version 0.0.419
• 30034c7 install: guide user to update PATH for current shell session
• 9277ab5 Update changelog.md for version 0.0.418
• f8396ae Merge pull request #1670 from github/RyanHecht-patch-1
• b54e97c Update README.md
• Additional commits viewable in compare view

Updates @github/copilot-sdk from 0.1.26 to 0.1.32

Release notes

Sourced from @​github/copilot-sdk's releases.

v0.1.32

Feature: backward compatibility with v2 CLI servers

SDK applications written against the v3 API now also work when connected to a v2 CLI server, with no code changes required.

Generated by Release Changelog Generator

Generated by Release Changelog Generator

v0.1.31

Feature: strongly-typed PermissionRequestResultKind for .NET and Go

Rather than comparing result.Kind against undiscoverable magic strings like "approved" or "denied-interactively-by-user", .NET and Go now provide typed constants. Node and Python already had typed unions for this; this brings full parity. (#631)

session.OnPermissionCompleted += (e) => {
    if (e.Result.Kind == PermissionRequestResultKind.Approved) { /* ... */ }
    if (e.Result.Kind == PermissionRequestResultKind.DeniedInteractivelyByUser) { /* ... */ }
};

// Go: PermissionKindApproved, PermissionKindDeniedByRules,
//     PermissionKindDeniedCouldNotRequestFromUser, PermissionKindDeniedInteractivelyByUser
if result.Kind == copilot.PermissionKindApproved { /* ... */ }

Other changes

• feature: [Python] [Go] add get_last_session_id() / GetLastSessionID() for SDK-wide parity (was already available in Node and .NET) (#671)
• improvement: [Python] add timeout parameter to generated RPC methods, allowing callers to override the default 30s timeout for long-running operations (#681)
• bugfix: [Go] PermissionRequest fields are now properly typed (ToolName, Diff, Path, etc.) instead of a generic Extra map[string]any catch-all (#685)

Generated by Release Changelog Generator

v0.1.30

Feature: support overriding built-in tools

Applications can now override built-in tools such as grep, edit_file, or read_file. To do this, register a custom tool with the same name and set the override flag. Without the flag, the runtime will return an error if the name clashes with a built-in. (#636)

import { defineTool } from "`@github/copilot-sdk`";
const session = await client.createSession({
tools: [defineTool("grep", {
overridesBuiltInTool: true,
</tr></table>

... (truncated)

Changelog

Sourced from @​github/copilot-sdk's changelog.

v0.1.32 (2026-03-07)

Feature: backward compatibility with v2 CLI servers

SDK applications written against the v3 API now also work when connected to a v2 CLI server, with no code changes required. The SDK detects the server's protocol version and automatically adapts v2 tool.call and permission.request messages into the same user-facing handlers used by v3. (#706)

const session = await client.createSession({
  tools: [myTool],           // unchanged — works with v2 and v3 servers
  onPermissionRequest: approveAll,
});

var session = await client.CreateSessionAsync(new SessionConfig {
    Tools = [myTool],          // unchanged — works with v2 and v3 servers
    OnPermissionRequest = approveAll,
});

v0.1.31 (2026-03-07)

Feature: multi-client tool and permission broadcasts (protocol v3)

The SDK now uses protocol version 3, where the runtime broadcasts external_tool.requested and permission.requested as session events to all connected clients. This enables multi-client architectures where different clients contribute different tools, or where multiple clients observe the same permission prompts — if one client approves, all clients see the result. Your existing tool and permission handler code is unchanged. (#686)

// Two clients each register different tools; the agent can use both
const session1 = await client1.createSession({
  tools: [defineTool("search", { handler: doSearch })],
  onPermissionRequest: approveAll,
});
const session2 = await client2.resumeSession(session1.id, {
  tools: [defineTool("analyze", { handler: doAnalyze })],
  onPermissionRequest: approveAll,
});

var session1 = await client1.CreateSessionAsync(new SessionConfig {
    Tools = [AIFunctionFactory.Create(DoSearch, "search")],
    OnPermissionRequest = PermissionHandlers.ApproveAll,
});
var session2 = await client2.ResumeSessionAsync(session1.Id, new ResumeSessionConfig {
    Tools = [AIFunctionFactory.Create(DoAnalyze, "analyze")],
    OnPermissionRequest = PermissionHandlers.ApproveAll,
});

Feature: strongly-typed PermissionRequestResultKind for .NET and Go

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.