build(deps): bump the production-dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the production-dependencies group with 6 updates in the / directory:

Package	From	To
@github/copilot-sdk	0.2.2	1.0.8
@inquirer/prompts	8.4.1	8.5.2
chalk	5.6.2	6.0.0
commander	14.0.3	15.0.0
ink	7.0.0	7.1.1
react	19.2.5	19.2.8

Updates @github/copilot-sdk from 0.2.2 to 1.0.8

Release notes

Sourced from @​github/copilot-sdk's releases.

GitHub Copilot SDK for Java 1.0.8

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central](https://github.com/github/copilot-sdk/blob/HEAD/(central.sonatype.com/redacted)

📖 [Documentation](https://github.com/github/copilot-sdk/blob/HEAD/(github.github.io/redacted) · [Javadoc](https://github.com/github/copilot-sdk/blob/HEAD/(github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.8</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.8")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.8'

Feature: per-agent reasoning effort

CustomAgentConfig now accepts an optional reasoningEffort field that controls the reasoning intensity for a specific sub-agent. Omitting it inherits the session-level effort; omitting it at both levels leaves the choice to the backend. (#1981)

CustomAgentConfig agent = new CustomAgentConfig()
    .setName("coder")
    .setReasoningEffort("high");

Other changes

• improvement: [Java] strongly type the internal expAssignments session-config field with CopilotExpAssignmentResponse to match the runtime wire contract (#2033)

[!WARNING]

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

... (truncated)

Changelog

Sourced from @​github/copilot-sdk's changelog.

Changelog

All notable changes to the Copilot SDK are documented in this file.

This changelog is automatically generated by an AI agent when stable releases are published. See GitHub Releases for the full list.

v1.0.7 (2026-07-16)

Feature: in-process (FFI) transport

The SDK can now host the Copilot runtime in-process by loading the native runtime library via its C ABI (FFI), eliminating the overhead of spawning a child process. This experimental transport is available for Node.js, Rust, Python, and Go. (#1953, #1915, #1975, #1976)

const client = new CopilotClient({ connection: RuntimeConnection.forInProcess() });

var client = new CopilotClient(new CopilotClientOptions { Connection = RuntimeConnection.ForInProcess() });

Feature: tool search configuration

A new toolSearch session option controls how the SDK defers tools when the total tool count exceeds a threshold. When enabled (the default), excess MCP and external tools are surfaced on demand through the built-in tool_search_tool rather than pre-loaded into every prompt. Tool results can also include toolReferences to link cited sources back to the tool that produced them. (#1933)

const session = await client.createSession({
    toolSearch: { defer: "auto" },
});

var session = await client.CreateSessionAsync(new SessionConfig
{
    ToolSearch = new ToolSearchConfig { Defer = "auto" },
});

Feature: opaque metadata passthrough on tool definitions

Tool definitions now accept an optional metadata bag that is forwarded verbatim in session.create and session.resume RPC calls. This lets hosts attach namespaced, implementation-specific metadata to tools without expanding the typed public contract; unknown keys are preserved and round-tripped untouched. (#1864)

session.defineTool("my-tool", { metadata: { "myapp:priority": 1 } }, handler);

session.DefineTool("my-tool", new ToolOptions { Metadata = new() { ["myapp:priority"] = 1 } }, handler);

... (truncated)

Commits

• a54b0b5 Update @​github/copilot to 1.0.73 (#2055)
• f36e6be Fix consistency review PR delta detection (#2018)
• 5ca48b1 Use dependency groups for Python dev deps (#2038)
• 5cd5710 Fix ask_user starving the Rust SDK per-session event loop (#2034)
• 97e8f80 Durably document required secrets (#2046)
• 0d563bd docs: expand Azure Managed Identity BYOK guidance (#1995)
• 85946f2 docs: document sub-agent event attribution (#1878)
• cd2b10b [maven-release-plugin] prepare for next development iteration
• 24f1ac0 [maven-release-plugin] prepare release java/v1.0.8-preview.0
• 00ef6cc docs: update version references to 1.0.8-preview.0
• Additional commits viewable in compare view

Updates @inquirer/prompts from 8.4.1 to 8.5.2

Release notes

Sourced from @​inquirer/prompts's releases.

@​inquirer/prompts@​8.5.2

• Fix security warnings in external-editor

@​inquirer/prompts@​8.5.1

• Rolled back mute-stream dependency from v4 to v3 to undo breaking compatible engines.
• Added tooling to prevent regression of the above in the future. This surfaced our min engines already enforced a higher limit, so adjusted the explicit limits to match the current state.

@​inquirer/prompts@​8.5.0

• Feat: Read env variable INQUIRER_KEYBINDINGS to enable vim or emacs keybindings; making this a user preference instead of a library author preference. One caveat is doing so disable the search feature in the select prompt. Syntax: INQUIRER_KEYBINDINGS=vim,emacs.
• Fix: Line wraps would sometime cause the cursor to be mispositioned relative to the input.
• Chore: Bump dependencies.

@​inquirer/prompts@​8.4.3

• Fix: Windows rendering bug
• Fix: Preserve exact literal types in choices array (Typescript only)
• Fix: Allow input default value to be of type undefined (Typescript only)
• Bump dependencies

@​inquirer/prompts@​8.4.2

• Fix: some Windows terminals would freeze and not react to keypresses.

Commits

• bfd8710 chore: Publish new release
• 55cc5f3 feat: add reusable package lint CLI
• 3af9ed0 test(inquirer): capture prompt runner output
• 4381857 fix(@​inquirer/input): remove stale lint suppression
• 45df331 fix(@​inquirer/external-editor): harden editor temp files
• adef323 chore: limit CI token permissions
• b43359d chore: Publish new release
• 24ecae2 chore: fix yarn.lock
• b078d97 fix: validate package engine compatibility
• 3a49f9f chore(deps-dev): Bump oxfmt in the formatting group (#2143)
• Additional commits viewable in compare view

Updates chalk from 5.6.2 to 6.0.0

Release notes

Sourced from chalk's releases.

v6.0.0

Breaking

• Require Node.js 22 8a94e0e

Improvements

• Add underline styles and underline colors (#689) 4c304dd
• Improve performance 5729845 fa5cff2

Fixes

• Treat a numeric FORCE_COLOR as an exact level (#688) e912931
• Downsample ansi256() and bgAnsi256() to 16 colors at level 1 (#687) ff549c5

---

chalk/chalk@v5.6.2...v6.0.0

Commits

• 661317e 6.0.0
• 5729845 Improve performance
• 4c304dd Add extended underline styles and underline colors (#689)
• e912931 Fix: Treat a numeric FORCE_COLOR as an exact level (#688)
• 8a94e0e Require Node.js 22
• fa5cff2 Optimize 2-argument calls (#670)
• ff549c5 Fix: Downsample ansi256() and bgAnsi256() to 16 colors at level 1 (#687)
• 678e550 Tweaks
• aa06bb5 Fix typos (#664)
• See full diff in compare view

Updates commander from 14.0.3 to 15.0.0

Release notes

Sourced from commander's releases.

v15.0.0

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 moves Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

• show excess command-arguments in error message (#2384)

Fixed

• Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
• update example to use compatible character for MINGW64 (#2475)

Changed

• Breaking: migrated Commander implementation from CommonJS to ESM (#2464)
• Breaking: Commander 15 requires Node.js v22.12.0 or higher (for require(esm)).
• dev: switch tests from Jest to node:test test runner (#2463)

Deleted

• Breaking: removed deprecated export of commander/esm.mjs (#2464)

Migration Tips

Commander 15 is ESM only, but this does not mean you need to migrate to ESM to use it. Importing ESM from CommonJS is supported by Node.js, and Bun, and Deno. Hopefully it Just Works for you! However, you may be using a different runtime or some other part of your setup that may not yet natively support importing ESM from CommonJS, such as your testing framework or bundler.

If you have problems using Commander 15 in your environment, one option is stay on Commander 14 for now. Commander 14 will get security updates until May 2027 and things will hopefully improve for your setup in the meantime.

v15.0.0-0

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 in May 2026 will move Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

• show excess command-arguments in error message (#2384)

Fixed

• Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
• update example to use compatible character for MINGW64 (#2475)

... (truncated)

Changelog

Sourced from commander's changelog.

[15.0.0] (2026-05-29)

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 moves Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

• show excess command-arguments in error message (#2384)

Fixed

• Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
• update example to use compatible character for MINGW64 (#2475)

Changed

• Breaking: migrated Commander implementation from CommonJS to ESM (#2464)
• Breaking: Commander 15 requires Node.js v22.12.0 or higher (for require(esm)).
• dev: switch tests from Jest to node:test test runner (#2463)

Deleted

• Breaking: removed deprecated export of commander/esm.mjs (#2464)

Migration Tips

Commander 15 is ESM only, but this does not mean you need to migrate to ESM to use it. Importing ESM from CommonJS is supported by Node.js, and Bun, and Deno. Hopefully it Just Works for you! However, you may be using a different runtime or some other part of your setup that may not yet natively support importing ESM from CommonJS, such as your testing framework or bundler.

If you have problems using Commander 15 in your environment, one option is stay on Commander 14 for now. Commander 14 will get security updates until May 2027 and things will hopefully improve for your setup in the meantime.

[15.0.0-0] (2026-02-22)

(Released as 15.0.0)

Commits

• ba6d13d Fix release dates in changelog (#2523)
• a752ed9 Pin GitHub actions with hash (#2521)
• 74d5dfe Drop EOL node 20 from test matrix, and add node 26 (#2520)
• 6df9b68 Update details for 15.0.0 release (#2519)
• 01ce5d0 Remove jest esm examples (#2517)
• d785d8b Update dependencies (#2518)
• 9098b48 Update dependencies (#2506)
• 373f660 Use node:util stripVTControlCharacters instead of own code (#2486)
• 987f289 Use simple match in test (to avoid warning about expensive regex) (#2485)
• 0ea3bb3 Update dependecies and lint (#2489)
• Additional commits viewable in compare view

Updates ink from 7.0.0 to 7.1.1

Release notes

Sourced from ink's releases.

v7.1.1

• Fix: Preserve last <Static> line erased after a full-clear frame (#974) e51dfdd
• Make measureElement() also return position coordinates (#968) c073b27

---

vadimdemedes/ink@v7.1.0...v7.1.1

v7.1.0

• Add suspendTerminal() to hand the terminal to a child process (#972) 9e8ed1f

---

vadimdemedes/ink@v7.0.6...v7.1.0

v7.0.6

• Fix stale frames on Windows when output exactly fills the terminal (#971) 2c08d55

---

vadimdemedes/ink@v7.0.5...v7.0.6

v7.0.5

• Fix: Handle incomplete stack frames in error overview (#965) b2350c1

---

vadimdemedes/ink@v7.0.4...v7.0.5

v7.0.4

• Fix: Share resize listener via emitLayoutListeners instead of per-hook listeners (#952) 89d43d8
• Fix: Remove useEffectEvent functions from useEffect dependency arrays (#960) 9d534f7

---

vadimdemedes/ink@v7.0.3...v7.0.4

v7.0.3

• Fix: Drop stale <Static> output from fullStaticOutput on identity change (#950) 669c438
• Fix: <Static> remount via key change drops new items (#948) be9f44c
• Fix useBoxMetrics not accepting ref objects with an initial null value (#945) 7c2267c

---

vadimdemedes/ink@v7.0.2...v7.0.3

v7.0.2

• Fix: Defer raw mode disable to prevent process hang on component swap dd052ea

---

... (truncated)

Commits

• 70af033 7.1.1
• e51dfdd Fix: Preserve last \<Static> line erased after a full-clear frame (#974)
• 665eb44 Fix docs
• c073b27 Make measureElement() also return position coordinates (#968)
• 25766ae 7.1.0
• 9e8ed1f Add suspendTerminal() to hand the terminal to a child process (#972)
• c41a7a0 7.0.6
• 2c08d55 Fix stale frames on Windows when output exactly fills the terminal (#971)
• cb222fe 7.0.5
• dca5c06 Fix: Update to xo 2 (#962)
• Additional commits viewable in compare view

Updates react from 19.2.5 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

19.2.7 (June 1st, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @​unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

• Type hardening and performance improvements (#36425 by @​eps1lon and @​unstubbable)

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@​unstubbable #36566)

19.2.6 (May 6, 2026)

React Server Components

• Type hardening and performance improvements (@​eps1lon, @​unstubbable #36425)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• 6117d7c Version 19.2.7 (#36591)
• eaf3e95 Version 19.2.6
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates Node.js dependencies to newer major versions, likely to align with updated SDK and CLI tooling.

Changes:

• Bumped @github/copilot-sdk from ^0.2.0 to ^1.0.8
• Bumped chalk from ^5.6.2 to ^6.0.0
• Bumped commander from ^14.0.3 to ^15.0.0