Skip to content

deps: Bump GitHub.Copilot.SDK from 1.0.3 to 1.0.5#1449

Closed
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/nuget/src/Squad.Agents.AI/GitHub.Copilot.SDK-1.0.5
Closed

deps: Bump GitHub.Copilot.SDK from 1.0.3 to 1.0.5#1449
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/nuget/src/Squad.Agents.AI/GitHub.Copilot.SDK-1.0.5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 6, 2026

Copy link
Copy Markdown
Contributor

Updated GitHub.Copilot.SDK from 1.0.3 to 1.0.5.

Release notes

Sourced from GitHub.Copilot.SDK's releases.

1.0.5

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.5</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.5")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.5'

Feature: annotation-based tool API (@​CopilotTool)

The Java SDK now includes a high-level, annotation-driven tool API. Annotate methods with @​CopilotTool and parameters with @​CopilotToolParam to define tools — a JSR-269 annotation processor generates metadata at compile time with no runtime reflection. Use ToolDefinition.fromObject() to register tools with minimal boilerplate. (#​1792)

public class WeatherTools {
    `@​CopilotTool`("Get the current weather for a given city")
    public String getWeather(
            `@​CopilotToolParam`(value = "The city to get weather for", required = true) String city,
            `@​CopilotToolParam`(value = "Temperature unit: celsius or fahrenheit", defaultValue = "celsius") String unit) {
        // implementation
    }
}

List<ToolDefinition> tools = ToolDefinition.fromObject(new WeatherTools());
SessionConfig config = new SessionConfig().setTools(tools);

Feature: ToolInvocation injection in @​CopilotTool methods

... (truncated)

1.0.5-preview.1

What's Changed

New Contributors

Full Changelog: github/copilot-sdk@rust/v1.0.5-preview.0...rust/v1.0.5-preview.1

1.0.5-preview.0

What's Changed

New Contributors

Full Changelog: github/copilot-sdk@rust/v1.0.4...rust/v1.0.5-preview.0

1.0.4

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.4</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.4")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.4'

Feature: HTTP request callback support

Register a CopilotRequestHandler on the client to intercept every outbound LLM inference HTTP or WebSocket request — for both BYOK and CAPI — and mutate, replace, or fully forward it. Useful for logging, header injection, model substitution, or custom routing. (#​1689, #​1775, #​1784)

final class MyHandler extends CopilotRequestHandler {
    `@​Override`
    protected HttpResponse<InputStream> sendRequest(HttpRequest request, CopilotRequestContext ctx) throws Exception {
        HttpRequest mutated = HttpRequest.newBuilder(request, (n, v) -> true)
                .header("X-Debug-Session", ctx.sessionId() == null ? "none" : ctx.sessionId())
                .build();
        return super.sendRequest(mutated, ctx);
    }
}

CopilotClient client = new CopilotClient(
    new CopilotClientOptions().setRequestHandler(new MyHandler()));

Feature: getBearerToken callback for BYOK providers (Managed Identity)

... (truncated)

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
deps: Bump GitHub.Copilot.SDK from 1.0.3 to 1.0.5
28430f9 
---
updated-dependencies:
- dependency-name: GitHub.Copilot.SDK
  dependency-version: 1.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: squad:belanna. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 6, 2026
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 6, 2026
@tamirdresher

tamirdresher commented Jul 7, 2026

Copy link
Copy Markdown
Collaborator

Investigation Results: Root Cause Identified

TL;DR

GitHub.Copilot.SDK 1.0.5 introduced strong-naming, creating an assembly identity breaking change. This is NOT a simple version bump — it's a binary-incompatible change.

Root Cause

  • SDK 1.0.3: GitHub.Copilot.SDK, Version=1.0.3.0, PublicKeyToken=null (unsigned)
  • SDK 1.0.5: GitHub.Copilot.SDK, Version=1.0.5.0, PublicKeyToken=cc7b13ffcd2ddd51 (strong-named)

The Microsoft.Agents.AI.GitHub.Copilot adapter (from Microsoft Agent Framework) was compiled against the unsigned SDK assembly (Version=1.0.0.0, PublicKeyToken=null). When a consumer references the new strong-named SDK 1.0.5, the .NET runtime sees two completely different assemblies — binding redirects CANNOT bridge a PublicKeyToken mismatch.

Reproduction

Minimal .NET project referencing both packages triggers CS0012:

error CS0012: The type 'CopilotClient' is defined in an assembly that is not referenced.
You must add a reference to assembly 'GitHub.Copilot.SDK, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null'.

Recommendation

  1. Close this PR — the SDK upgrade cannot work until the upstream adapter is recompiled
  2. Pin SDK to 1.0.3 (last unsigned release) as the workaround
  3. Upstream fix needed: microsoft/agent-framework needs to bump their dotnet/Directory.Packages.props from GitHub.Copilot.SDK version 1.0.0 to 1.0.5 and publish a new adapter package

I'm filing an issue on microsoft/agent-framework with the reproduction and proposed fix.

@tamirdresher

tamirdresher commented Jul 7, 2026

Copy link
Copy Markdown
Collaborator

Update: Filed upstream issue microsoft/agent-framework#6948 with root cause analysis, minimal reproduction, and proposed fix (bump GitHub.Copilot.SDK from 1.0.0 to 1.0.5 in dotnet/Directory.Packages.props).

Once the upstream fix is released, the Dependabot bump in this PR should work cleanly.

tamirdresher
tamirdresher requested changes Jul 7, 2026
View reviewed changes

@tamirdresher tamirdresher left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Requesting changes — this bump introduces a hard build break. .NET SDK 1.0.5 repackaged CopilotClient into an assembly that isn't referenced, producing CS0012 (CopilotClient in unreferenced assembly), and also renamed bearerTokenProvider. The consuming code needs the new package reference plus the renamed parameter before this can merge.

@dependabot @github

dependabot Bot commented on behalf of github Jul 13, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #1471.

@dependabot dependabot Bot closed this Jul 13, 2026
@dependabot dependabot Bot deleted the dependabot/nuget/src/Squad.Agents.AI/GitHub.Copilot.SDK-1.0.5 branch July 13, 2026 08:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tamirdresher tamirdresher tamirdresher requested changes
@bradygaster bradygaster Awaiting requested review from bradygaster bradygaster is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tamirdresher