Modernize dependencies across SDKs by stephentoub · Pull Request #2736 · github/copilot-sdk

stephentoub · 2026-09-20T20:37:30Z

Three open Dependabot alerts originate from a vulnerable js-yaml path in the Node samples lockfile, while dependencies across the monorepo have accumulated additional safe upgrades and unused entries. This change refreshes the repository dependency graph while preserving supported runtimes and minimizing unnecessary transitive duplication.

What changed

Regenerated npm lockfiles so the vulnerable sample dependency path is removed; all npm audits report zero vulnerabilities.
Updated and pruned dependencies across Node.js, Python, Go, .NET, Rust, and Java.
Applied a seven-day release cooldown to npm, NuGet, and Python updates.
Removed unused packages and obsolete configuration, while retaining opt-in Source Link and coverage tooling.
Adapted code for newer TypeScript, vscode-jsonrpc, OpenAI, Python typing, Rust, and Checkstyle APIs.
Pinned SQLitePCLRaw.lib.e_sqlite3 2.1.13 to use the upstream fix for the missing Win-ARM asset pulled by Microsoft.Data.Sqlite 10.0.12.
Selected Rust versions and features to avoid active multi-version crate duplication.

Intentional holds

Node SDK TypeScript remains on 6.x because the current @typescript-eslint release does not support TypeScript 7.
Vitest remains on 4.x, OpenAI on 6.x, and @platformatic/vfs on 0.3.x to preserve Node 20 support.
Selected Rust dependencies remain below their latest major releases where upgrading would add duplicate crate versions.

Validation

npm lockfile publication dates and vulnerability audits were checked across all seven npm projects.
Node.js type checking, build, lint, unit tests, harness tests, corrections tests, and TypeScript documentation validation pass.
Go tests, vet, lint, and tidy checks pass.
Python linting, type checking, packaging, and unit tests pass.
Java Maven verification, formatting, Checkstyle, and code generation tests pass.
.NET restore, build, formatting, and non-E2E tests pass for net8.0 and net472.
Rust formatting, check, Clippy, non-E2E tests, and targeted WebSocket E2E tests pass.

Full cross-language E2E runs still contain environment-dependent failures from missing extension SDK configuration or replay fixtures; these are unrelated to the dependency updates.

Generated by Copilot

Copilot · 2026-09-20T20:42:31Z

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Install Go dependencies

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

Copilot

Copilot review overview

🟡 Changes recommended

The Go module directives unnecessarily drop documented and CI-tested Go 1.24 support.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 2

Open (2)

Go module requires unsupported Go 1.25 · New
Samples require unsupported Go 1.25 · New

What changed in this PR

Modernizes dependencies across the SDK monorepo, updates compatibility code, and prunes obsolete tooling.

Changes:

Refreshes dependencies and lockfiles across all SDKs.
Adapts code and generated types for upgraded libraries.
Updates linting, build, and test configuration.

File	Description
`test/harness/tsconfig.json`	Uses bundler module resolution.
`test/harness/subagentHooksReplay.test.ts`	Handles optional tool functions.
`test/harness/responsesApiAdapter.ts`	Adds cache-write usage data.
`test/harness/package.json`	Updates harness dependencies.
`scripts/docs-validation/package.json`	Updates and prunes dependencies.
`scripts/docs-validation/package-lock.json`	Refreshes documentation tooling lockfile.
`scripts/corrections/package.json`	Updates correction-script tooling.
`scripts/corrections/collect-corrections.js`	Preserves callable CommonJS exports.
`scripts/codegen/typescript.ts`	Updates generated JSON-RPC imports.
`scripts/codegen/package.json`	Updates code-generation dependencies.
`scripts/codegen/package-lock.json`	Refreshes code-generation lockfile.
`rust/tests/e2e/copilot_request_handler.rs`	Adapts WebSocket test messages.
`rust/src/lib.rs`	Migrates to the new getrandom API.
`rust/src/copilot_request_handler.rs`	Adapts WebSocket payload types.
`rust/clippy.toml`	Updates disallowed-macro configuration.
`rust/Cargo.toml`	Updates Rust dependencies and features.
`rust/build/in_process.rs`	Adapts SHA-256 formatting.
`python/pyproject.toml`	Updates Python build and development dependencies.
`python/copilot/session.py`	Narrows OAuth grant typing.
`python/copilot/copilot_request_handler.py`	Removes obsolete type suppressions.
`python/copilot/client.py`	Always supplies the configured log level.
`nodejs/tsconfig.test.json`	Sets the test source root.
`nodejs/tsconfig.json`	Updates module resolution and source root.
`nodejs/test/structured-output.test.ts`	Updates JSON-RPC import path.
`nodejs/test/session-send-and-wait.test.ts`	Updates JSON-RPC import path.
`nodejs/test/message-source.test.ts`	Updates JSON-RPC import path.
`nodejs/test/factory.test.ts`	Updates JSON-RPC import path.
`nodejs/test/e2e/extension_env_access.e2e.test.ts`	Updates JSON-RPC import path.
`nodejs/test/client.test.ts`	Updates dynamic JSON-RPC import.
`nodejs/src/session.ts`	Sanitizes elicitation content and updates imports.
`nodejs/src/generated/session-events.ts`	Regenerates session-event types.
`nodejs/src/generated/rpc.ts`	Regenerates RPC types.
`nodejs/src/client.ts`	Updates JSON-RPC import path.
`nodejs/samples/package.json`	Updates sample tooling dependencies.
`nodejs/package.json`	Updates SDK dependencies and tooling.
`java/sdk/pom.xml`	Updates testing, formatting, and Checkstyle dependencies.
`java/sdk/config/spotbugs/spotbugs-exclude.xml`	Removes obsolete SpotBugs exclusions.
`java/sdk/config/checkstyle/checkstyle.xml`	Migrates Javadoc validation.
`java/scripts/codegen/package-lock.json`	Refreshes Java codegen dependencies.
`java/pom.xml`	Removes SpotBugs and updates Spotless.
`go/samples/go.sum`	Refreshes sample dependency checksums.
`go/samples/go.mod`	Updates sample dependencies and Go requirement.
`go/go.sum`	Refreshes SDK dependency checksums.
`go/go.mod`	Updates SDK dependencies and Go requirement.
`dotnet/test/GitHub.Copilot.SDK.Test.csproj`	Adds the pinned SQLite native package.
`dotnet/Directory.Packages.props`	Updates centralized NuGet versions.

Files not reviewed (5)

java/scripts/codegen/package-lock.json: Generated file
scripts/codegen/package-lock.json: Generated file
scripts/corrections/package-lock.json: Generated file
scripts/docs-validation/package-lock.json: Generated file
test/harness/package-lock.json: Generated file

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Update and prune dependencies across all SDK ecosystems while preserving compatibility and removing the vulnerable js-yaml paths behind the open Dependabot alerts. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Restore Go 1.24-compatible dependency versions, refresh generated outputs, and align formatting with the updated toolchain. Keep Node codegen tests self-contained and run Java CodeQL under JDK 25. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Apply the repository's nightly rustfmt configuration to generated Rust output so code generation and clippy checks agree in CI. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Treat assistant text accompanying a read_agent call as non-semantic when it follows a successful subagent completion notification, while still requiring the exact tool call and result history. Add regression coverage for the macOS CI ordering. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-09-21T00:56:35Z

SDK Consistency Review — PR #2736

Reviewed the authoritative PR delta (pull_request_read get_files + get_diff, all 65 changed files). This PR is a maintenance/dependency-bump PR (CodeQL Java build support, package-version bumps across .NET/Go/Java/Node/Python/Rust, and regenerated types from an updated pinned Copilot CLI schema), not a new-feature PR — so cross-language feature-parity is not the primary concern here. Findings:

No cross-SDK parity gaps found

The regenerated nodejs/src/generated/rpc.ts / session-events.ts and python/copilot/generated/rpc.py changes (e.g. AccountLogoutRequest gaining an intersection type with selectionId, index-signature | undefined additions, UIElicitationSchemaProperty union tweaks) are auto-generated from the same upstream schema and only touched in the languages whose generated files appear in this diff — Go/.NET/Java/Rust generated sources are untouched here, which is expected since they're regenerated independently and weren't part of this PR's scope.
Dependency/tooling bumps (dotnet/Directory.Packages.props, go.mod/go.sum, java/pom.xml, nodejs/package.json, python/pyproject.toml, rust/Cargo.toml) are each scoped to their own ecosystem, as expected — no inconsistency to flag.

Targeted bug fixes — reviewed for parity, no action needed

nodejs/src/session.ts now filters undefined entries out of the elicitation result's content map before returning it to callers (new ElicitationFieldValue import + Object.entries(...).filter(...)). This addresses a TypeScript-specific quirk in how the generated index-signature type surfaces missing keys. Go (fromRPCElicitationResult/fromRPCContent) and .NET (ElicitAsync) already build their content maps by iterating only real entries, and Python's content is a plain deserialized dict — so this fix doesn't reveal an equivalent gap in the other SDKs.
python/copilot/client.py: _start_inprocess_ffi now always passes --log-level (previously guarded by if opts.log_level:). Since log_level is a non-optional Literal[...] defaulting to "info", this is a safe simplification, not a behavior change, and doesn't need mirroring elsewhere.
python/copilot/copilot_request_handler.py: adds a None guard on self._upstream before iterating, and reorders exception-checking logic — internal robustness fixes local to the Python asyncio implementation, no equivalent pattern needed in other SDKs.
rust/: updates are mechanical adaptations to newer crate APIs (tokio-tungstenite's Bytes-based Message variants, getrandom::fill replacing getrandom::getrandom, SHA-256 digest formatting) — purely internal to Rust's dependency versions.

Conclusion

No cross-SDK API inconsistencies or missing feature parity issues were identified. The PR maintains consistency across the six SDK implementations.

Generated by SDK Consistency Review Agent for #2736 · copilot · sonnet50 · 93.3 AIC · ⌖ 12.5 AIC · ⊞ 7.8K · ◷

stephentoub requested a review from a team as a code owner September 20, 2026 20:37

Copilot AI balanced review requested due to automatic review settings September 20, 2026 20:37

Copilot started reviewing on behalf of stephentoub September 20, 2026 20:38 View session

Copilot AI reviewed Sep 20, 2026

View reviewed changes

Comment thread go/go.mod Outdated

Comment thread go/samples/go.mod Outdated

This comment has been minimized.

Sign in to view

stephentoub and others added 4 commits September 20, 2026 20:47

Modernize repository dependencies

8e24641

Update and prune dependencies across all SDK ecosystems while preserving compatibility and removing the vulnerable js-yaml paths behind the open Dependabot alerts. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Use pinned Rust formatting

49982b9

Apply the repository's nightly rustfmt configuration to generated Rust output so code generation and clippy checks agree in CI. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

stephentoub force-pushed the stephentoub-modernize-dependencies branch from e7d13b5 to ead7b5e Compare September 21, 2026 00:48

stephentoub requested a review from roji September 21, 2026 00:55

Navigation Menu

Modernize dependencies across SDKs - #2736

Modernize dependencies across SDKs#2736
stephentoub wants to merge 4 commits into
mainfrom
stephentoub-modernize-dependencies

stephentoub commented Sep 20, 2026

Uh oh!

Copilot AI commented Sep 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

github-actions Bot commented Sep 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

stephentoub commented Sep 20, 2026

What changed

Intentional holds

Validation

Uh oh!

Copilot AI commented Sep 20, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

github-actions Bot commented Sep 21, 2026

SDK Consistency Review — PR #2736

No cross-SDK parity gaps found

Targeted bug fixes — reviewed for parity, no action needed

Conclusion

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants