• Update the release workflow to use the built-in GitHub Actions token for Copilot authentication, removing the dependency on a nonexistent secret and adding an optional draft input for publishing releases. (#16)
• Bump js-yaml to 4.3.1 to resolve a quadratic CPU consumption vulnerability in !!omap resolution during YAML parsing. (#15)
• Bump brace-expansion and undici dependencies in the npm_and_yarn group to their patched versions. (#14)
• Update the brace-expansion development dependency to 1.1.16 to address a denial-of-service vulnerability from exponential-time brace pattern expansion. (#12)
• Update the js-yaml development dependency to 4.3.0 to fix a quadratic CPU consumption issue when parsing chained YAML merge keys. (#11)

Security

• Resolved 4 Dependabot alerts for undici by upgrading to 6.27.0 and rebuilding the bundled dist/ (denial of service via WebSocket fragment count, HTTP header injection via Set-Cookie percent-decoding, response queue poisoning via keep-alive socket reuse, and Set-Cookie SameSite downgrade). None are reachable in this action's code paths; upgrading clears the alerts for consumers' scanners.
• Resolved Dependabot alerts for js-yaml, @babel/core, and additional transitive dependencies in the test toolchain.

Notes

• No functional changes to release-note generation; this is a maintenance and dependency-hardening release.

Fixed

• Improved PR discovery for repos using GitHub API strategy

Documentation

• Added Background and Requirements sections to README
• Updated all references from desktop/copilot-release-notes to github/copilot-release-notes

Security

• Resolved 5 Dependabot alerts for handlebars (1 critical, 3 high, 1 low)
• Resolved 1 moderate brace-expansion vulnerability

Copilot Release Notes v1.0.0

AI-powered release notes generation from pull requests between two git refs, using GitHub Copilot CLI.

Features

• Zero configuration — works out of the box with sensible defaults
• Team-customizable — drop a style guide at .github/release-notes-instructions.md and the action follows your conventions
• Structured output — markdown and JSON outputs for releases, changelogs, Slack, or dashboards
• Uncertainty flagging — entries the AI isn't confident about are separated for human review

Usage

- name: Generate release notes
  uses: github/copilot-release-notes@v1
  with:
    base-ref: v1.0.0
    head-ref: v1.1.0
  env:
    COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

See the README for full documentation.