Skip to content

build(deps): bump the production-dependencies group across 1 directory with 6 updates - #387

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-4f40a19c20
Open

build(deps): bump the production-dependencies group across 1 directory with 6 updates#387
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-4f40a19c20

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 6 updates in the / directory:

Package From To
@github/copilot-sdk 0.2.0 1.0.14
@inquirer/prompts 8.4.1 8.7.2
chalk 5.6.2 6.0.0
commander 14.0.3 15.0.0
ink 7.0.0 7.1.1
react 19.2.5 19.3.0

Updates @github/copilot-sdk from 0.2.0 to 1.0.14

Release notes

Sourced from @​github/copilot-sdk's releases.

v1.0.14

Feature: typed message provenance for user, system, and agent sources

Messages sent through the SDK can now carry typed source provenance, distinguishing human user input, internal system injections, and identified agent- senders, so recipients can reliably tell agent input from human authorization. (#2573)

await session.send("Looks good to me.", { source: "agent-reviewer" });
await session.send("Looks good to me.", source=AgentMessageSource("reviewer"))

Feature: Auto model routing Fast tier

Sessions using auto model routing can now select the fast tier alongside the existing efficiency, balance, and intelligence tiers, giving integrators a latency-focused routing preset across all six SDKs. (#2669)

await session.setAutoTier("fast");

Feature: force-refresh managed settings cache

The new managedSettings.clearCache RPC method wipes the persistent server-policy cache and drops the runtime's in-memory retained policy, giving hosts a primitive for a "force refresh account policy" action. (#2438)

await client.rpc.managedSettings.clearCache();
await client.Rpc.ManagedSettings.ClearCacheAsync();

Feature: Rust SDK model allowlists

SessionConfig and ResumeSessionConfig in the Rust SDK now accept an optional allowed_models list, letting hosts restrict which model IDs a session may use without duplicating runtime validation. (#2512)

let config = SessionConfig::default().with_allowed_models(["gpt-4o", "claude-3.7-sonnet"]);

Other changes

  • feature: [Core] add factory pause checkpoints for the Node.js Agent Factories API, letting a paused run resume without losing invocation limits or execution identity (#2537)
  • feature: forward the optional host OAuth client metadata URL across all six SDKs on session create and resume (#2258)
  • feature: [TypeScript] add max_output_tokens to the model capabilities override, previously unreachable without an unsafe cast (#2569)
  • bugfix: [.NET] include Copilot CLI runtime assets in PackAsTool packages so dotnet pack --no-build produces a working tool (#2557)
  • bugfix: apply the runtime's connection_close callback-quiescence contract consistently across all six in-process C ABI adapters, preventing races with freed callback state during disposal (#2610, #2622)
  • bugfix: [Rust] fix codegen for CLI 1.0.84 schemas, correctly mapping the CatalogTrustEligibility unknown value and re-exporting shared session-event types (#2631)
  • bugfix: [C#] fix codegen for runtime schema unions, unblocking single-variant anyOf/oneOf handling (#2656)

... (truncated)

Changelog

Sourced from @​github/copilot-sdk's changelog.

v1.0.14 (2026-09-16)

Feature: typed message provenance for user, system, and agent sources

Messages sent through the SDK can now carry typed source provenance, distinguishing human user input, internal system injections, and identified agent- senders, so recipients can reliably tell agent input from human authorization. (#2573)

await session.send("Looks good to me.", { source: "agent-reviewer" });
await session.send("Looks good to me.", source=AgentMessageSource("reviewer"))

Feature: Auto model routing Fast tier

Sessions using auto model routing can now select the fast tier alongside the existing efficiency, balance, and intelligence tiers, giving integrators a latency-focused routing preset across all six SDKs. (#2669)

await session.setAutoTier("fast");

Feature: force-refresh managed settings cache

The new managedSettings.clearCache RPC method wipes the persistent server-policy cache and drops the runtime's in-memory retained policy, giving hosts a primitive for a "force refresh account policy" action. (#2438)

await client.rpc.managedSettings.clearCache();
await client.Rpc.ManagedSettings.ClearCacheAsync();

Feature: Rust SDK model allowlists

SessionConfig and ResumeSessionConfig in the Rust SDK now accept an optional allowed_models list, letting hosts restrict which model IDs a session may use without duplicating runtime validation. (#2512)

let config = SessionConfig::default().with_allowed_models(["gpt-4o", "claude-3.7-sonnet"]);

Other changes

  • feature: [Core] add factory pause checkpoints for the Node.js Agent Factories API, letting a paused run resume without losing invocation limits or execution identity (#2537)
  • feature: forward the optional host OAuth client metadata URL across all six SDKs on session create and resume (#2258)
  • feature: [TypeScript] add max_output_tokens to the model capabilities override, previously unreachable without an unsafe cast (#2569)
  • bugfix: [.NET] include Copilot CLI runtime assets in PackAsTool packages so dotnet pack --no-build produces a working tool (#2557)
  • bugfix: apply the runtime's connection_close callback-quiescence contract consistently across all six in-process C ABI adapters, preventing races with freed callback state during disposal (#2610, #2622)
  • bugfix: [Rust] fix codegen for CLI 1.0.84 schemas, correctly mapping the CatalogTrustEligibility unknown value and re-exporting shared session-event types (#2631)

... (truncated)

Commits

Updates @inquirer/prompts from 8.4.1 to 8.7.2

Release notes

Sourced from @​inquirer/prompts's releases.

@​inquirer/prompts@​8.7.2

What's new

  • Fixed a race where keystrokes batched in the same tick as the key that settled a prompt could still reach keypress handlers after the prompt was done, cancelled, or aborted (@inquirer/core, #2255, closes #1816).
  • confirm() now trims surrounding whitespace from answers before matching yes/no keywords (@inquirer/confirm, #2254).

Included

  • @inquirer/checkbox@^5.2.5
  • @inquirer/confirm@^6.3.2
  • @inquirer/editor@^5.3.3
  • @inquirer/expand@^5.1.5
  • @inquirer/input@^5.1.6
  • @inquirer/number@^4.2.3
  • @inquirer/password@^5.2.2
  • @inquirer/rawlist@^5.3.5
  • @inquirer/search@^4.3.3
  • @inquirer/select@^5.2.5

@​inquirer/prompts@​8.7.1

What's new

  • All bundled prompts now pin @inquirer/type to an exact version in their published manifests. Since these type definitions leak into consumers' tsc runs, a semver range on the types-only dependency could break downstream TypeScript builds without any change to Inquirer.js itself (#2247, fixes #2244).

Included

  • @inquirer/checkbox@^5.2.4
  • @inquirer/confirm@^6.3.1
  • @inquirer/editor@^5.3.2
  • @inquirer/expand@^5.1.4
  • @inquirer/input@^5.1.5
  • @inquirer/number@^4.2.2
  • @inquirer/password@^5.2.1
  • @inquirer/rawlist@^5.3.4
  • @inquirer/search@^4.3.2
  • @inquirer/select@^5.2.4

@​inquirer/prompts@​8.7.0

What's new

  • password gains the toggleMask option (ctrl+t to reveal the typed value).
  • confirm now matches localized yes/no answers per-locale.
  • Prettified prompt and theme types for better IDE display.
  • Added inquirer-grouped-checkbox to the community prompts list (#2236).

Included

... (truncated)

Commits
  • cbdb34b chore: Publish new release
  • 8340d2d fix(@​inquirer/core): clear hook effects before settling prompts
  • 2475e07 test(@​inquirer/core): cover hook cleanup error semantics
  • 15cd8d3 fix(confirm): ignore surrounding whitespace in answers
  • 9cb0da6 chore(deps): Bump github/codeql-action/analyze from 4.37.7 to 4.37.9
  • 1c750bc chore(deps-dev): Bump the build group with 3 updates (#2251)
  • 81f1525 chore(deps-dev): Bump @​types/node in the types group (#2252)
  • 7c27f26 chore(deps-dev): Bump oxfmt in the formatting group (#2249)
  • 6119088 chore(deps): Bump github/codeql-action/init from 4.37.7 to 4.37.9 (#2250)
  • 0d167c0 chore(deps-dev): Bump the linting group with 4 updates (#2248)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​inquirer/prompts since your current version.


Updates chalk from 5.6.2 to 6.0.0

Release notes

Sourced from chalk's releases.

v6.0.0

Breaking

  • Require Node.js 22 8a94e0e

Improvements

  • Add underline styles and underline colors (#689) 4c304dd
  • Improve performance 5729845 fa5cff2

Fixes

  • Treat a numeric FORCE_COLOR as an exact level (#688) e912931
  • Downsample ansi256() and bgAnsi256() to 16 colors at level 1 (#687) ff549c5

chalk/chalk@v5.6.2...v6.0.0

Commits

Updates commander from 14.0.3 to 15.0.0

Release notes

Sourced from commander's releases.

v15.0.0

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 moves Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

  • show excess command-arguments in error message (#2384)

Fixed

  • Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
  • update example to use compatible character for MINGW64 (#2475)

Changed

  • Breaking: migrated Commander implementation from CommonJS to ESM (#2464)
  • Breaking: Commander 15 requires Node.js v22.12.0 or higher (for require(esm)).
  • dev: switch tests from Jest to node:test test runner (#2463)

Deleted

  • Breaking: removed deprecated export of commander/esm.mjs (#2464)

Migration Tips

Commander 15 is ESM only, but this does not mean you need to migrate to ESM to use it. Importing ESM from CommonJS is supported by Node.js, and Bun, and Deno. Hopefully it Just Works for you! However, you may be using a different runtime or some other part of your setup that may not yet natively support importing ESM from CommonJS, such as your testing framework or bundler.

If you have problems using Commander 15 in your environment, one option is stay on Commander 14 for now. Commander 14 will get security updates until May 2027 and things will hopefully improve for your setup in the meantime.

v15.0.0-0

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 in May 2026 will move Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

  • show excess command-arguments in error message (#2384)

Fixed

  • Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
  • update example to use compatible character for MINGW64 (#2475)

... (truncated)

Changelog

Sourced from commander's changelog.

[15.0.0] (2026-05-29)

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 moves Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

  • show excess command-arguments in error message (#2384)

Fixed

  • Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
  • update example to use compatible character for MINGW64 (#2475)

Changed

  • Breaking: migrated Commander implementation from CommonJS to ESM (#2464)
  • Breaking: Commander 15 requires Node.js v22.12.0 or higher (for require(esm)).
  • dev: switch tests from Jest to node:test test runner (#2463)

Deleted

  • Breaking: removed deprecated export of commander/esm.mjs (#2464)

Migration Tips

Commander 15 is ESM only, but this does not mean you need to migrate to ESM to use it. Importing ESM from CommonJS is supported by Node.js, and Bun, and Deno. Hopefully it Just Works for you! However, you may be using a different runtime or some other part of your setup that may not yet natively support importing ESM from CommonJS, such as your testing framework or bundler.

If you have problems using Commander 15 in your environment, one option is stay on Commander 14 for now. Commander 14 will get security updates until May 2027 and things will hopefully improve for your setup in the meantime.

[15.0.0-0] (2026-02-22)

(Released as 15.0.0)

Commits

Updates ink from 7.0.0 to 7.1.1

Release notes

Sourced from ink's releases.

v7.1.1

  • Fix: Preserve last <Static> line erased after a full-clear frame (#974) e51dfdd
  • Make measureElement() also return position coordinates (#968) c073b27

vadimdemedes/ink@v7.1.0...v7.1.1

v7.1.0

vadimdemedes/ink@v7.0.6...v7.1.0

v7.0.6

  • Fix stale frames on Windows when output exactly fills the terminal (#971) 2c08d55

vadimdemedes/ink@v7.0.5...v7.0.6

v7.0.5

  • Fix: Handle incomplete stack frames in error overview (#965) b2350c1

vadimdemedes/ink@v7.0.4...v7.0.5

v7.0.4

  • Fix: Share resize listener via emitLayoutListeners instead of per-hook listeners (#952) 89d43d8
  • Fix: Remove useEffectEvent functions from useEffect dependency arrays (#960) 9d534f7

vadimdemedes/ink@v7.0.3...v7.0.4

v7.0.3

  • Fix: Drop stale <Static> output from fullStaticOutput on identity change (#950) 669c438
  • Fix: <Static> remount via key change drops new items (#948) be9f44c
  • Fix useBoxMetrics not accepting ref objects with an initial null value (#945) 7c2267c

vadimdemedes/ink@v7.0.2...v7.0.3

v7.0.2

  • Fix: Defer raw mode disable to prevent process hang on component swap dd052ea

... (truncated)

Commits

Updates react from 19.2.5 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 23, 2026
Copilot AI lite review requested due to automatic review settings September 23, 2026 05:56
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 23, 2026
Copilot AI reviewed Sep 23, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

The advertised Node.js engine range is broader than the runtime support of the upgraded dependencies.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 Medium severity

Open (1)
What changed in this PR

Refreshes production dependencies and regenerates the npm lockfile.

Changes:

  • Upgrades Copilot SDK, Chalk, Commander, Inquirer, Ink, and React.
  • Refreshes transitive and platform-specific runtime dependencies.
File Summary
package.json Updates production dependency ranges.
package-lock.json Records resolved dependency versions and integrity data.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread package.json
"chalk": "^5.6.2",
"commander": "^14.0.3",
"chalk": "^6.0.0",
"commander": "^15.0.0",
@dependabot
build(deps): bump the production-dependencies group across 1 director…
53adc9b 
…y with 6 updates

Bumps the production-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@github/copilot-sdk](https://github.com/github/copilot-sdk) | `0.2.0` | `1.0.14` |
| [@inquirer/prompts](https://github.com/SBoudrias/Inquirer.js) | `8.4.1` | `8.7.2` |
| [chalk](https://github.com/chalk/chalk) | `5.6.2` | `6.0.0` |
| [commander](https://github.com/tj/commander.js) | `14.0.3` | `15.0.0` |
| [ink](https://github.com/vadimdemedes/ink) | `7.0.0` | `7.1.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.5` | `19.3.0` |



Updates `@github/copilot-sdk` from 0.2.0 to 1.0.14
- [Release notes](https://github.com/github/copilot-sdk/releases)
- [Changelog](https://github.com/github/copilot-sdk/blob/main/CHANGELOG.md)
- [Commits](github/copilot-sdk@v0.2.0...v1.0.14)

Updates `@inquirer/prompts` from 8.4.1 to 8.7.2
- [Release notes](https://github.com/SBoudrias/Inquirer.js/releases)
- [Commits](https://github.com/SBoudrias/Inquirer.js/compare/@inquirer/prompts@8.4.1...@inquirer/prompts@8.7.2)

Updates `chalk` from 5.6.2 to 6.0.0
- [Release notes](https://github.com/chalk/chalk/releases)
- [Commits](chalk/chalk@v5.6.2...v6.0.0)

Updates `commander` from 14.0.3 to 15.0.0
- [Release notes](https://github.com/tj/commander.js/releases)
- [Changelog](https://github.com/tj/commander.js/blob/master/CHANGELOG.md)
- [Commits](tj/commander.js@v14.0.3...v15.0.0)

Updates `ink` from 7.0.0 to 7.1.1
- [Release notes](https://github.com/vadimdemedes/ink/releases)
- [Commits](vadimdemedes/ink@v7.0.0...v7.1.1)

Updates `react` from 19.2.5 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

---
updated-dependencies:
- dependency-name: "@github/copilot-sdk"
  dependency-version: 1.0.14
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@inquirer/prompts"
  dependency-version: 8.7.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: chalk
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: commander
  dependency-version: 15.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: ink
  dependency-version: 7.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump the production-dependencies group with 6 updates build(deps): bump the production-dependencies group across 1 directory with 6 updates Sep 23, 2026
Copilot AI review requested due to automatic review settings September 23, 2026 21:00
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-4f40a19c20 branch from 09f3e65 to 53adc9b Compare September 23, 2026 21:00
Copilot AI reviewed Sep 23, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

The declared Node.js engine range permits unsupported Node 22.0–22.11 runtimes.

Review effort: Lite
Findings: 1 Medium severity

Open (1)

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@pierceboggan Pierce Boggan (pierceboggan) Awaiting requested review from pierceboggan pierceboggan is a code owner
@digitarald Harald Kirschner (digitarald) Awaiting requested review from digitarald digitarald is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant