chore(deps): bump the all-npm group across 1 directory with 7 updates

[dependabot]

Bumps the all-npm group with 7 updates in the / directory:

Package	From	To
@github/copilot-sdk	1.0.1	1.0.5
tsx	4.22.4	4.23.0
@playwright/test	1.61.0	1.61.1
eslint	10.5.0	10.6.0
lint-staged	17.0.7	17.0.8
prettier	3.8.4	3.9.4
better-sqlite3	12.10.1	12.11.1

Updates @github/copilot-sdk from 1.0.1 to 1.0.5

Release notes

Sourced from @​github/copilot-sdk's releases.

GitHub Copilot SDK for Java 1.0.5

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central](https://github.com/github/copilot-sdk/blob/HEAD/(central.sonatype.com/redacted)

📖 [Documentation](https://github.com/github/copilot-sdk/blob/HEAD/(github.github.io/redacted) · [Javadoc](https://github.com/github/copilot-sdk/blob/HEAD/(github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.5</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.5")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.5'

---

Feature: annotation-based tool API (@CopilotTool)

The Java SDK now includes a high-level, annotation-driven tool API. Annotate methods with @CopilotTool and parameters with @CopilotToolParam to define tools — a JSR-269 annotation processor generates metadata at compile time with no runtime reflection. Use ToolDefinition.fromObject() to register tools with minimal boilerplate. (#1792)

public class WeatherTools {
    `@CopilotTool`("Get the current weather for a given city")
    public String getWeather(
            `@CopilotToolParam`(value = "The city to get weather for", required = true) String city,
            `@CopilotToolParam`(value = "Temperature unit: celsius or fahrenheit", defaultValue = "celsius") String unit) {
        // implementation
    }
}
List<ToolDefinition> tools = ToolDefinition.fromObject(new WeatherTools());
SessionConfig config = new SessionConfig().setTools(tools);

Feature: ToolInvocation injection in @CopilotTool methods

... (truncated)

Changelog

Sourced from @​github/copilot-sdk's changelog.

v1.0.5 (2026-07-01)

Feature: MCP OAuth host token handlers

SDK applications can now handle OAuth challenges from MCP servers that require host-provided authentication. Register an onMcpAuthRequest callback on the session config and the SDK will invoke it whenever an MCP server responds with a 401 WWW-Authenticate challenge; return an access token (or cancel the request). Supports initial auth, refresh, reauth, and upscope flows across all SDKs. (#1669)

const session = await client.createSession({
    onMcpAuthRequest: async (request) => ({
        accessToken: await myIdentityProvider.getToken(request.serverUrl),
    }),
});

var session = await client.CreateSessionAsync(new SessionConfig
{
    OnMcpAuthRequest = async ctx =>
        McpAuthResult.FromToken(new McpAuthToken
        {
            AccessToken = await myIdentityProvider.GetTokenAsync(ctx.ServerUrl)
        }),
});

Feature: session options for citations, excluded agents, and spending limits

Three additional session configuration options are now available across all SDKs. (#1865)

const session = await client.createSession({
    enableCitations: true,
    excludedBuiltinAgents: ["github-search"],
    sessionLimits: { maxAiCredits: 10 },
});

var session = await client.CreateSessionAsync(new SessionConfig
{
    EnableCitations = true,
    ExcludedBuiltInAgents = ["github-search"],
    SessionLimits = new SessionLimitsConfig { MaxAiCredits = 10 },
});

Other changes

• improvement: [All SDKs] rename BYOK callback field getBearerToken → bearerTokenProvider; add sessionId to ProviderTokenArgs for per-session token scoping (#1796)
• bugfix: [Node] fix MCP OAuth registerInterest sent before session.resume, causing "Session not found" errors when resuming a session with onMcpAuthRequest (#1861)

... (truncated)

Commits

• 62ffcfe docs: add session limits guidance (#1856)
• 1047dfb docs: update billing information for GitHub Copilot SDK usage (#1854)
• cbc3026 Fix MCP OAuth resume order in Node.js SDK (#1861)
• 64dcd25 Expose new session options across SDKs (#1865)
• b168366 Update @​github/copilot to 1.0.67 (#1860)
• cc66206 Update @​github/copilot to 1.0.66 (#1859)
• 6189f84 [maven-release-plugin] prepare for next development iteration
• 5657aab [maven-release-plugin] prepare release java/v1.0.5
• d98a6c5 docs: update version references to 1.0.5
• 91eaa4b Add MCP OAuth lifecycle SDK support (#1669)
• Additional commits viewable in compare view

Updates tsx from 4.22.4 to 4.23.0

Release notes

Sourced from tsx's releases.

v4.23.0

4.23.0 (2026-07-03)

Bug Fixes

• avoid redundant filesystem probes during module resolution (257bbbb), closes privatenumber/tsx#809

Features

• add multi-scenario startup benchmark suite (c178197), closes privatenumber/tsx#809 #809 hi#signal privatenumber/tsx#145 #809

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.5

4.22.5 (2026-07-02)

Bug Fixes

• isolate hook state per async module.register() registration (a305f36)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 1dfad37 docs: cite esbuild's extension-resolution model in node notes
• 257bbbb fix: avoid redundant filesystem probes during module resolution
• c178197 feat: add multi-scenario startup benchmark suite
• 51800ac docs: add Node internals knowledge base (notes/node)
• a305f36 fix: isolate hook state per async module.register() registration
• ca501a9 chore: upgrade skills-npm to v1.2.0
• 596cd1f test: cover __dirname, __filename, & require.cache in CJS TS file
• 75d9bf0 test: lock in lenient ESM for ambiguous and CJS-typed packages
• 1472f3e test: cover ESM-syntax dependency with omitted "type" field
• See full diff in compare view

Updates @playwright/test from 1.61.0 to 1.61.1

Release notes

Sourced from @​playwright/test's releases.

v1.61.1

Bug Fixes

• #41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
• #41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
• #41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
• #41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
• #41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

Commits

• 39e3553 cherry-pick(#41399): fix(test): load require-reached files as commonjs in syn...
• 4328122 chore: mark v1.61.1 (#41404)
• 2c29a94 fix(tracing): stop recording websocket frames outside of chunks (#41398)
• 4324b19 cherry-pick(#41367): fix(test): keep builtin expect matchers on base extend
• 041e7e3 cherry-pick(#41364): fix(har): WebSocket message timestamps should be in mi...
• b8a0fc3 cherry-pick(#41309, #43149): Revert "fix(firefox): treat `navigationCommitted...
• b5a3175 cherry-pick(#41319): fix(loader): support other node versions
• d4724a9 cherry-pick(#41290): feat(docker): add Ubuntu 26.04 (Resolute Raccoon) image
• See full diff in compare view

Updates eslint from 10.5.0 to 10.6.0

Release notes

Sourced from eslint's releases.

v10.6.0

Features

• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)
• f291007 feat: add checkRelationalComparisons to no-constant-binary-expression (#20948) (sethamus)

Bug Fixes

• 6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#20997) (Milos Djermanovic)
• bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#21013) (den$)
• 8fd8741 fix: don't report shadowed undefined in radix rule (#21011) (Pixel)
• 5784980 fix: don't report shadowed undefined in no-throw-literal (#21010) (Pixel)
• 9cd1e6d fix: suppress invalid class suggestion in no-promise-executor-return (#21008) (Pixel)
• d4eb2dc fix: don't report shadowed undefined in prefer-promise-reject-errors (#21006) (Pixel)
• 2360464 fix: prefer-promise-reject-errors false positives for shadowed Promise (#21003) (den$)
• 63d52d2 fix: restore max-classes-per-file report range (#21002) (Pixel)
• 7feaff0 fix: callback detection logic for IIFEs in max-nested-callbacks (#20979) (fnx)
• 399a2ec fix: don't report inner non-callbacks in max-nested-callbacks (#20995) (Milos Djermanovic)

Documentation

• a83683d docs: Update README (GitHub Actions Bot)
• f5449f9 docs: document userland patterns for global assertionOptions in RuleT… (#20986) (playgirl)
• bea49f7 docs: Update README (GitHub Actions Bot)
• e5f70f9 docs: update code-path diagrams (#20984) (Tanuj Kanti)
• 8890c2d docs: add TypeScript config guidance for MCP server (#20796) (Pierluigi Lenoci)
• 3eb3d9b docs: Update README (GitHub Actions Bot)
• c5bb59c docs: Update README (GitHub Actions Bot)
• eb3c97c docs: fix grammar in prefer-const rule description (#20983) (lumir)

Chores

• 6a42034 ci: run ecosystem tests on main branch (#20891) (sethamus)
• 3dbacdb ci: bump actions/checkout from 6 to 7 (#21014) (dependabot[bot])
• c3abfca chore: correct JSDoc param types in html formatter (#21018) (Minseon Kim)
• a832320 ci: split ecosystem tests into separate jobs (#21001) (xbinaryx)
• 27166e7 chore: update ecosystem plugins (#21005) (ESLint Bot)
• 865d76e ci: bump pnpm/action-setup from 6.0.8 to 6.0.9 (#20989) (dependabot[bot])
• 27a88c9 chore: update dependency markdown-it to v14 in root (#20994) (Milos Djermanovic)
• 970cea6 chore: update dependency markdown-it to v14 (#20993) (Milos Djermanovic)
• b482120 chore: update dependency prettier to v3.8.4 (#20990) (renovate[bot])
• 6993fb3 chore: update ecosystem plugins (#20985) (ESLint Bot)

Commits

• 5d12a04 10.6.0
• f7ca54b Build: changelog update for 10.6.0
• 6a42034 ci: run ecosystem tests on main branch (#20891)
• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981)
• 3dbacdb ci: bump actions/checkout from 6 to 7 (#21014)
• c3abfca chore: correct JSDoc param types in html formatter (#21018)
• a83683d docs: Update README
• a832320 ci: split ecosystem tests into separate jobs (#21001)
• 6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#20997)
• bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#21013)
• Additional commits viewable in compare view

Updates lint-staged from 17.0.7 to 17.0.8

Release notes

Sourced from lint-staged's releases.

v17.0.8

Patch Changes

• #1809 179b437 - Fix lint-staged discarding the ongoing merge conflict status (.git/MERGE_HEAD) when using the --hide-unstaged or --hide-all options.

• #1811 3d0b2c0 - Fix issues with Git commands that are successful but also emit warnings to stderr, by ignoring the stderr output completely when the process exits with code 0. This was the behavior when using nano-spawn and execa, but when switching to tinyexec in 16.3.0 both stdout and stderr were used as interleaved output.

Changelog

Sourced from lint-staged's changelog.

17.0.8

Patch Changes

• #1809 179b437 - Fix lint-staged discarding the ongoing merge conflict status (.git/MERGE_HEAD) when using the --hide-unstaged or --hide-all options.

• #1811 3d0b2c0 - Fix issues with Git commands that are successful but also emit warnings to stderr, by ignoring the stderr output completely when the process exits with code 0. This was the behavior when using nano-spawn and execa, but when switching to tinyexec in 16.3.0 both stdout and stderr were used as interleaved output.

Commits

• 5f3b8f2 Merge pull request #1812 from lint-staged/changeset-release/main
• 43a9b8d chore(changeset): release
• 630e2f6 Merge pull request #1809 from lint-staged/restore-merge-status
• 179b437 fix: restore Git merge status after creating backup stash
• 6bae2e2 Merge pull request #1811 from lint-staged/exec-git-ignore-stderr
• b82a830 ci: run npm audit omitting dev, including prod dependencies
• 0b19b80 build(deps): update dependencies
• 3d0b2c0 fix: ignore stderr when doing Git operations
• See full diff in compare view

Updates prettier from 3.8.4 to 3.9.4

Release notes

Sourced from prettier's releases.

3.9.4

• Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @​seiyab)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @​evoactivity)

🔗 Changelog

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

• Fix Flow variance annotation print (#19022 by @​marcoww6)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.4

diff

Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

<!-- Input -->
<FancyButton [label]="title">
  @content (icon) {
    <span>Icon!</span>
  }
  @content (description) {
    <span>Description text</span>
  }
  <span>Other children</span>
</FancyButton>
<!-- Prettier 3.9.3 -->
<FancyButton [label]="title">
@​content(icon) {
<span>Icon!</span>
}
@​content(description) {
<span>Description text</span>
}
<span>Other children</span>
</FancyButton>
<!-- Prettier 3.9.4 -->
<FancyButton [label]="title">
@​content (icon) {
<span>Icon!</span>
}
@​content (description) {
<span>Description text</span>
}
<span>Other children</span>
</FancyButton>

3.9.3

diff

Markdown: Fix unexpected removal of characters in liquid syntax (#19489 by @​seiyab)

</tr></table> 

... (truncated)

Commits

• b693cb2 Release 3.9.4
• 2e92ac0 Angular: Format @content(name) -> @content (name) to align with other blo...
• abed2c2 Bump Prettier dependency to 3.9.3
• 6cfbc00 Clean changelog_unreleased
• 3732e1d Release 3.9.3
• a74a7b0 Allow decorators to be used with declare on class fields (#19492)
• bd9e11a Correct text identification in liquid syntax (#19489)
• 269eee3 Bump Prettier dependency to 3.9.1
• ec7ccd1 Clean changelog_unreleased
• c47654c Release 3.9.1
• Additional commits viewable in compare view

Updates better-sqlite3 from 12.10.1 to 12.11.1

Release notes

Sourced from better-sqlite3's releases.

v12.11.1

What's Changed

• Fix Electron v42 build errors on Windows by @​m4heshd in WiseLibs/better-sqlite3#1488

Full Changelog: WiseLibs/better-sqlite3@v12.11.0...v12.11.1

v12.11.0

⚠️CAUTION: NOT A VIABLE RELEASE

Use v12.11.1 instead.

What's Changed

• Add missing Electron v42 build target by @​m4heshd in WiseLibs/better-sqlite3#1486

Full Changelog: WiseLibs/better-sqlite3@v12.10.1...v12.11.0

Commits

• 4cbc39c 12.11.1
• 02b743f Fix Electron v42 build errors on Windows (#1488)
• 39a6e55 12.11.0
• f36d8c6 Add missing Electron v42 build target (#1486)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	93.4%	8552 / 9156
🔵	Statements	93.4%	8552 / 9156
🔵	Functions	94.04%	221 / 235
🔵	Branches	87.88%	2176 / 2476

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Unchanged Files
bin/termbeam.js	61.62%	76.31%	50%	61.62%	40-63, 82-83, 89-117, 128, 142-146, 150-151, 155-157
src/cli/client.js	100%	97.67%	88.88%	100%
src/cli/index.js	94.97%	89.51%	100%	94.97%	132-135, 214-216, 218-220, 307-309, 327-329, 335, 353-356
src/cli/interactive.js	100%	98.21%	100%	100%
src/cli/prompts.js	94.52%	94.82%	100%	94.52%	73-74, 92-95, 101-102
src/cli/resume.js	99.04%	92.61%	88.88%	99.04%	42-43, 416, 419
src/cli/service.js	91.03%	84.97%	100%	91.03%	455-480, 498-499, 503-505, 507-512, 523-531, 540-546, 568-569, 642-655
src/server/auth.js	100%	96.87%	100%	100%
src/server/copilot-sdk.js	96.92%	93.78%	100%	96.92%	35-36, 52-59, 73-75, 89-90, 112-113, 203, 308
src/server/index.js	84.29%	81.73%	87.5%	84.29%	115-116, 251, 253, 258, 260-261, 263-264, 271-272, 275-277, 291-293, 296-323, 369-370, 373, 404-406, 414-415, 457-463, 512-535
src/server/preferences.js	95.42%	81.9%	100%	95.42%	97, 99-100, 105, 107-108, 245-246, 248-250, 269-270
src/server/preview.js	95.68%	90%	100%	95.68%	93-97
src/server/push.js	100%	92.85%	100%	100%
src/server/routes.js	89.64%	80.77%	70.58%	89.64%	33-34, 46-47, 68-70, 73-74, 130-132, 186-203, 275-286, 291-332, 347, 507-508, 529-530, 591-593, 605-607, 746-747, 807, 809-810, 856-857, 864-865, 893-894, 908-909, 955-956, 958-959, 1004-1005, 1024-1025, 1043-1045, 1095-1096, 1170-1172, 1201-1203, 1219-1221, 1241-1243, 1333-1334, 1340-1343, 1374-1375, 1396-1398, 1447-1448, 1463-1464, 1488-1489, 1517-1519, 1527-1529, 1544-1545, 1550-1551, 1559-1560, 1580-1581, 1597-1598
src/server/sessions.js	93.32%	90.24%	86.66%	93.32%	10-24, 65-71, 78-79, 182-184, 256-258, 275-276, 432-435
src/server/websocket.js	96.11%	91.95%	100%	96.11%	249, 302, 404-409, 428-429, 431-432, 439-440, 460-461, 464-465, 472-473
src/utils/agent-sessions.js	93.4%	81.92%	100%	93.4%	73-74, 130-138, 163-164, 172-174, 186-187, 278
src/utils/agents.js	100%	83.33%	100%	100%
src/utils/git.js	94.43%	91.13%	100%	94.43%	24, 30-31, 41-48, 63-64, 250-251, 368-380
src/utils/logger.js	100%	100%	100%	100%
src/utils/shells.js	100%	100%	100%	100%
src/utils/update-check.js	91.05%	84.05%	93.33%	91.05%	202-204, 341-355, 370-383, 399-402, 420-423
src/utils/update-executor.js	98.92%	95.06%	100%	98.92%	316-317, 334-335
src/utils/vapid.js	100%	100%	100%	100%
src/utils/version.js	97.77%	92.3%	100%	97.77%	86-87

Generated in workflow #921 for commit 86861dc by the Vitest Coverage Report Action