chore(deps): bump the all-npm group with 6 updates

[dependabot]

Bumps the all-npm group with 6 updates:

Package	From	To
@github/copilot-sdk	1.0.1	1.0.4
@playwright/test	1.61.0	1.61.1
eslint	10.5.0	10.6.0
lint-staged	17.0.7	17.0.8
prettier	3.8.4	3.9.3
better-sqlite3	12.10.1	12.11.1

Updates @github/copilot-sdk from 1.0.1 to 1.0.4

Release notes

Sourced from @​github/copilot-sdk's releases.

GitHub Copilot SDK for Java 1.0.4

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central](https://github.com/github/copilot-sdk/blob/HEAD/(central.sonatype.com/redacted)

📖 [Documentation](https://github.com/github/copilot-sdk/blob/HEAD/(github.github.io/redacted) · [Javadoc](https://github.com/github/copilot-sdk/blob/HEAD/(github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.4</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.4")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.4'

---

Feature: HTTP request callback support

Register a CopilotRequestHandler on the client to intercept every outbound LLM inference HTTP or WebSocket request — for both BYOK and CAPI — and mutate, replace, or fully forward it. Useful for logging, header injection, model substitution, or custom routing. (#1689, #1775, #1784)

final class MyHandler extends CopilotRequestHandler {
    `@Override`
    protected HttpResponse<InputStream> sendRequest(HttpRequest request, CopilotRequestContext ctx) throws Exception {
        HttpRequest mutated = HttpRequest.newBuilder(request, (n, v) -> true)
                .header("X-Debug-Session", ctx.sessionId() == null ? "none" : ctx.sessionId())
                .build();
        return super.sendRequest(mutated, ctx);
    }
}
CopilotClient client = new CopilotClient(
new CopilotClientOptions().setRequestHandler(new MyHandler()));

... (truncated)

Changelog

Sourced from @​github/copilot-sdk's changelog.

java/v1.0.4 (2026-06-25)

Feature: HTTP request callback support

Register a CopilotRequestHandler on the client to intercept every outbound LLM inference HTTP or WebSocket request — for both BYOK and CAPI — and mutate, replace, or fully forward it. Useful for logging, header injection, model substitution, or custom routing. (#1689, #1775, #1784)

final class MyHandler extends CopilotRequestHandler {
    @Override
    protected HttpResponse<InputStream> sendRequest(HttpRequest request, CopilotRequestContext ctx) throws Exception {
        HttpRequest mutated = HttpRequest.newBuilder(request, (n, v) -> true)
                .header("X-Debug-Session", ctx.sessionId() == null ? "none" : ctx.sessionId())
                .build();
        return super.sendRequest(mutated, ctx);
    }
}
CopilotClient client = new CopilotClient(
new CopilotClientOptions().setRequestHandler(new MyHandler()));

Feature: getBearerToken callback for BYOK providers (Managed Identity)

BYOK provider configs now accept a getBearerToken callback so the SDK consumer can resolve bearer tokens (e.g. Azure Managed Identity) on demand. The SDK takes zero Azure SDK dependency — the consumer supplies the callback using any identity library. (#1748)

var provider = new ProviderConfig()
    .setType("openai")
    .setBaseUrl(baseUrl)
    .setGetBearerToken(args -> cred.getToken(ctx).map(AccessToken::getToken).toFuture());

Feature: experimental multi-provider BYOK registry

Register multiple named providers and models on a single session via NamedProviderConfig and ProviderModelConfig. Custom agents can reference provider-qualified model IDs such as "alpha/sonnet". This feature is experimental. (#1718)

Feature: preamble system message section and preserve action

Two new customization options for system message sections. SystemMessageSections.PREAMBLE targets only the identity preamble without affecting its sibling sub-sections (identity and tool_instructions are now documented as section groups). The new preserve action protects an individually-addressable section from a group-level remove. (#1713)

Other changes

• feature: add optional memory configuration (MemoryConfiguration) to session create and resume (#1617)
• feature: defer parameter on tool definitions controls eager vs. lazy tool loading ("auto" or "never") (#1632)
• feature: otlpProtocol telemetry option for configuring OTLP export transport ("http/json" or "http/protobuf") (#1648)
• feature: ModelBilling.tokenPrices surfaced on public SDK types, exposing per-tier pricing and context window limits (#1633)
• feature: CapiSessionOptions.enableWebSocketResponses and ProviderConfig.transport for WebSocket transport control on session create/resume (#1711)
• improvement: call runtime.shutdown during client stop for deterministic OTEL telemetry flush before process cleanup (#1667)
• improvement: rename SystemPromptSections → SystemMessageSections for cross-SDK consistency; old class deprecated with forRemoval=true (#1683)

... (truncated)

Commits

• e7d2bd3 Add getBearerToken callback for BYOK providers (Managed Identity) (#1748)
• 4d13613 Update @​github/copilot to 1.0.65 (#1793)
• 23d9a45 Expose exp_assignments injection on session create/resume across all SDKs (#1...
• 079c558 normalize-sharing-prompts-during-iteration (#1729)
• 7aa67e5 Add embeddedcli.Path() accessor for the resolved CLI path (#1677)
• 481ccac docs: add system message customization section to Python README (#1066)
• 460b48a fix(nodejs): handle stdio stdin errors (#1584)
• 59168f0 Add preamble section and preserve action to SDKs (#1713)
• b82f552 Document Java memory section and add Copilot Memory links across SDK READMEs ...
• a8255cb Clean up HTTP passthrough API (#1784)
• Additional commits viewable in compare view

Updates @playwright/test from 1.61.0 to 1.61.1

Release notes

Sourced from @​playwright/test's releases.

v1.61.1

Bug Fixes

• #41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
• #41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
• #41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
• #41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
• #41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

Commits

• 39e3553 cherry-pick(#41399): fix(test): load require-reached files as commonjs in syn...
• 4328122 chore: mark v1.61.1 (#41404)
• 2c29a94 fix(tracing): stop recording websocket frames outside of chunks (#41398)
• 4324b19 cherry-pick(#41367): fix(test): keep builtin expect matchers on base extend
• 041e7e3 cherry-pick(#41364): fix(har): WebSocket message timestamps should be in mi...
• b8a0fc3 cherry-pick(#41309, #43149): Revert "fix(firefox): treat `navigationCommitted...
• b5a3175 cherry-pick(#41319): fix(loader): support other node versions
• d4724a9 cherry-pick(#41290): feat(docker): add Ubuntu 26.04 (Resolute Raccoon) image
• See full diff in compare view

Updates eslint from 10.5.0 to 10.6.0

Release notes

Sourced from eslint's releases.

v10.6.0

Features

• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)
• f291007 feat: add checkRelationalComparisons to no-constant-binary-expression (#20948) (sethamus)

Bug Fixes

• 6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#20997) (Milos Djermanovic)
• bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#21013) (den$)
• 8fd8741 fix: don't report shadowed undefined in radix rule (#21011) (Pixel)
• 5784980 fix: don't report shadowed undefined in no-throw-literal (#21010) (Pixel)
• 9cd1e6d fix: suppress invalid class suggestion in no-promise-executor-return (#21008) (Pixel)
• d4eb2dc fix: don't report shadowed undefined in prefer-promise-reject-errors (#21006) (Pixel)
• 2360464 fix: prefer-promise-reject-errors false positives for shadowed Promise (#21003) (den$)
• 63d52d2 fix: restore max-classes-per-file report range (#21002) (Pixel)
• 7feaff0 fix: callback detection logic for IIFEs in max-nested-callbacks (#20979) (fnx)
• 399a2ec fix: don't report inner non-callbacks in max-nested-callbacks (#20995) (Milos Djermanovic)

Documentation

• a83683d docs: Update README (GitHub Actions Bot)
• f5449f9 docs: document userland patterns for global assertionOptions in RuleT… (#20986) (playgirl)
• bea49f7 docs: Update README (GitHub Actions Bot)
• e5f70f9 docs: update code-path diagrams (#20984) (Tanuj Kanti)
• 8890c2d docs: add TypeScript config guidance for MCP server (#20796) (Pierluigi Lenoci)
• 3eb3d9b docs: Update README (GitHub Actions Bot)
• c5bb59c docs: Update README (GitHub Actions Bot)
• eb3c97c docs: fix grammar in prefer-const rule description (#20983) (lumir)

Chores

• 6a42034 ci: run ecosystem tests on main branch (#20891) (sethamus)
• 3dbacdb ci: bump actions/checkout from 6 to 7 (#21014) (dependabot[bot])
• c3abfca chore: correct JSDoc param types in html formatter (#21018) (Minseon Kim)
• a832320 ci: split ecosystem tests into separate jobs (#21001) (xbinaryx)
• 27166e7 chore: update ecosystem plugins (#21005) (ESLint Bot)
• 865d76e ci: bump pnpm/action-setup from 6.0.8 to 6.0.9 (#20989) (dependabot[bot])
• 27a88c9 chore: update dependency markdown-it to v14 in root (#20994) (Milos Djermanovic)
• 970cea6 chore: update dependency markdown-it to v14 (#20993) (Milos Djermanovic)
• b482120 chore: update dependency prettier to v3.8.4 (#20990) (renovate[bot])
• 6993fb3 chore: update ecosystem plugins (#20985) (ESLint Bot)

Commits

• 5d12a04 10.6.0
• f7ca54b Build: changelog update for 10.6.0
• 6a42034 ci: run ecosystem tests on main branch (#20891)
• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981)
• 3dbacdb ci: bump actions/checkout from 6 to 7 (#21014)
• c3abfca chore: correct JSDoc param types in html formatter (#21018)
• a83683d docs: Update README
• a832320 ci: split ecosystem tests into separate jobs (#21001)
• 6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#20997)
• bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#21013)
• Additional commits viewable in compare view

Updates lint-staged from 17.0.7 to 17.0.8

Release notes

Sourced from lint-staged's releases.

v17.0.8

Patch Changes

• #1809 179b437 - Fix lint-staged discarding the ongoing merge conflict status (.git/MERGE_HEAD) when using the --hide-unstaged or --hide-all options.

• #1811 3d0b2c0 - Fix issues with Git commands that are successful but also emit warnings to stderr, by ignoring the stderr output completely when the process exits with code 0. This was the behavior when using nano-spawn and execa, but when switching to tinyexec in 16.3.0 both stdout and stderr were used as interleaved output.

Changelog

Sourced from lint-staged's changelog.

17.0.8

Patch Changes

• #1809 179b437 - Fix lint-staged discarding the ongoing merge conflict status (.git/MERGE_HEAD) when using the --hide-unstaged or --hide-all options.

• #1811 3d0b2c0 - Fix issues with Git commands that are successful but also emit warnings to stderr, by ignoring the stderr output completely when the process exits with code 0. This was the behavior when using nano-spawn and execa, but when switching to tinyexec in 16.3.0 both stdout and stderr were used as interleaved output.

Commits

• 5f3b8f2 Merge pull request #1812 from lint-staged/changeset-release/main
• 43a9b8d chore(changeset): release
• 630e2f6 Merge pull request #1809 from lint-staged/restore-merge-status
• 179b437 fix: restore Git merge status after creating backup stash
• 6bae2e2 Merge pull request #1811 from lint-staged/exec-git-ignore-stderr
• b82a830 ci: run npm audit omitting dev, including prod dependencies
• 0b19b80 build(deps): update dependencies
• 3d0b2c0 fix: ignore stderr when doing Git operations
• See full diff in compare view

Updates prettier from 3.8.4 to 3.9.3

Release notes

Sourced from prettier's releases.

3.9.3

• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @​seiyab)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @​evoactivity)

🔗 Changelog

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

• Fix Flow variance annotation print (#19022 by @​marcoww6)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.3

diff

Markdown: Fix unexpected removal of characters in liquid syntax (#19489 by @​seiyab)

// Input
<!-- Input -->
{{ page.title
}} text
<!-- Prettier 3.9.1 -->
{{ page.title
text
<!-- Prettier 3.9.3 -->
{{ page.title
}} text

TypeScript: Allow decorators to be used with declare on class fields (#19492 by @​evoactivity)

Extensively used within the Ember ecosystem, decorators with declare on class fields will ignore the babel parser error and allow Prettier to format the code without breaking it.

// Input
export default class ProjectStatusComponent extends Component<ProjectStatusSig> {
  @service declare server: ServerService;
}
// Prettier 3.9.1
// SyntaxError: Decorators can't be used with a declare field. (2:3)
//  1 | export default class ProjectStatusComponent extends Component<ProjectStatusSig> {
//> 2 |   @​service declare server: ServerService;
//    |   ^
//  3 | }
// Prettier 3.9.3
export default class ProjectStatusComponent extends Component<ProjectStatusSig> {
@​service declare server: ServerService;
}

3.9.1

diff

... (truncated)

Commits

• 3732e1d Release 3.9.3
• a74a7b0 Allow decorators to be used with declare on class fields (#19492)
• bd9e11a Correct text identification in liquid syntax (#19489)
• 269eee3 Bump Prettier dependency to 3.9.1
• ec7ccd1 Clean changelog_unreleased
• c47654c Release 3.9.1
• 06159aa Fix bug in release script
• 4bc5ab4 Update file-entry-cache to 11.1.5 (#19483)
• b7fd58b Release @prettier/plugin-oxc@0.2.0 and @prettier/plugin-hermes@0.2.0
• 3006400 Revert changes in release script
• Additional commits viewable in compare view

Updates better-sqlite3 from 12.10.1 to 12.11.1

Release notes

Sourced from better-sqlite3's releases.

v12.11.1

What's Changed

• Fix Electron v42 build errors on Windows by @​m4heshd in WiseLibs/better-sqlite3#1488

Full Changelog: WiseLibs/better-sqlite3@v12.11.0...v12.11.1

v12.11.0

⚠️CAUTION: NOT A VIABLE RELEASE

Use v12.11.1 instead.

What's Changed

• Add missing Electron v42 build target by @​m4heshd in WiseLibs/better-sqlite3#1486

Full Changelog: WiseLibs/better-sqlite3@v12.10.1...v12.11.0

Commits

• 4cbc39c 12.11.1
• 02b743f Fix Electron v42 build errors on Windows (#1488)
• 39a6e55 12.11.0
• f36d8c6 Add missing Electron v42 build target (#1486)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	93.4%	8552 / 9156
🔵	Statements	93.4%	8552 / 9156
🔵	Functions	94.04%	221 / 235
🔵	Branches	87.92%	2177 / 2476

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Unchanged Files
bin/termbeam.js	61.62%	76.31%	50%	61.62%	40-63, 82-83, 89-117, 128, 142-146, 150-151, 155-157
src/cli/client.js	100%	97.67%	88.88%	100%
src/cli/index.js	94.97%	89.51%	100%	94.97%	132-135, 214-216, 218-220, 307-309, 327-329, 335, 353-356
src/cli/interactive.js	100%	98.21%	100%	100%
src/cli/prompts.js	94.52%	94.82%	100%	94.52%	73-74, 92-95, 101-102
src/cli/resume.js	99.04%	92.61%	88.88%	99.04%	42-43, 416, 419
src/cli/service.js	91.03%	84.97%	100%	91.03%	455-480, 498-499, 503-505, 507-512, 523-531, 540-546, 568-569, 642-655
src/server/auth.js	100%	96.87%	100%	100%
src/server/copilot-sdk.js	96.92%	93.78%	100%	96.92%	35-36, 52-59, 73-75, 89-90, 112-113, 203, 308
src/server/index.js	84.29%	81.73%	87.5%	84.29%	115-116, 251, 253, 258, 260-261, 263-264, 271-272, 275-277, 291-293, 296-323, 369-370, 373, 404-406, 414-415, 457-463, 512-535
src/server/preferences.js	95.42%	81.9%	100%	95.42%	97, 99-100, 105, 107-108, 245-246, 248-250, 269-270
src/server/preview.js	95.68%	90%	100%	95.68%	93-97
src/server/push.js	100%	92.85%	100%	100%
src/server/routes.js	89.64%	80.98%	70.58%	89.64%	33-34, 46-47, 68-70, 73-74, 130-132, 186-203, 275-286, 291-332, 347, 507-508, 529-530, 591-593, 605-607, 746-747, 807, 809-810, 856-857, 864-865, 893-894, 908-909, 955-956, 958-959, 1004-1005, 1024-1025, 1043-1045, 1095-1096, 1170-1172, 1201-1203, 1219-1221, 1241-1243, 1333-1334, 1340-1343, 1374-1375, 1396-1398, 1447-1448, 1463-1464, 1488-1489, 1517-1519, 1527-1529, 1544-1545, 1550-1551, 1559-1560, 1580-1581, 1597-1598
src/server/sessions.js	93.32%	90.24%	86.66%	93.32%	10-24, 65-71, 78-79, 182-184, 256-258, 275-276, 432-435
src/server/websocket.js	96.11%	91.95%	100%	96.11%	249, 302, 404-409, 428-429, 431-432, 439-440, 460-461, 464-465, 472-473
src/utils/agent-sessions.js	93.4%	81.92%	100%	93.4%	73-74, 130-138, 163-164, 172-174, 186-187, 278
src/utils/agents.js	100%	83.33%	100%	100%
src/utils/git.js	94.43%	91.13%	100%	94.43%	24, 30-31, 41-48, 63-64, 250-251, 368-380
src/utils/logger.js	100%	100%	100%	100%
src/utils/shells.js	100%	100%	100%	100%
src/utils/update-check.js	91.05%	84.05%	93.33%	91.05%	202-204, 341-355, 370-383, 399-402, 420-423
src/utils/update-executor.js	98.92%	95.06%	100%	98.92%	316-317, 334-335
src/utils/vapid.js	100%	100%	100%	100%
src/utils/version.js	97.77%	92.3%	100%	97.77%	86-87

Generated in workflow #909 for commit 578baea by the Vitest Coverage Report Action

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.