Skip to content

build(deps): Bump the npm_and_yarn group across 3 directories with 5 updates#6

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/2.copilotWebRelay/npm_and_yarn-f40a13ab7c
Open

build(deps): Bump the npm_and_yarn group across 3 directories with 5 updates#6
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/2.copilotWebRelay/npm_and_yarn-f40a13ab7c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 16, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 3 updates in the /2.copilotWebRelay directory: ws, vite and @github/copilot.
Bumps the npm_and_yarn group with 4 updates in the /2.copilotWebRelay/backend directory: ws, esbuild, qs and @github/copilot.
Bumps the npm_and_yarn group with 1 update in the /2.copilotWebRelay/frontend directory: vite.

Updates ws from 8.20.0 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

  • Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

  • Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits
  • bca91ad [dist] 8.21.0
  • 2b2abd4 [security] Limit retained message parts
  • 78eabe2 [security] Add latest vulnerability to SECURITY.md
  • 5d9b316 [dist] 8.20.1
  • c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
  • ce2a3d6 [ci] Test on node 26
  • 58e45b8 [ci] Do not test on node 25
  • 5f26c24 [ci] Run the lint step on node 24
  • See full diff in compare view

Updates vite from 8.0.8 to 8.0.16

Release notes

Sourced from vite's releases.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

v8.0.10

Please refer to CHANGELOG.md for details.

v8.0.9

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.16 (2026-06-01)

Bug Fixes

8.0.15 (2026-06-01)

Features

Bug Fixes

  • capitalize error messages and remove spurious space in parse error (#22488) (85a0eff)
  • deps: update all non-major dependencies (#22511) (2686d7d)
  • dev: fix html-proxy cache key mismatch for /@fs/ HTML paths (#21762) (47c4213)
  • glob: error on relative glob in virtual module when no files match (#22497) (5c8e98f)
  • optimizer: close the rolldown bundle when write() rejects (#22528) (e3cfb9d)
  • resolve: provide onWarn for viteResolvePlugin in JS plugin containers (#22509) (40985f1)

Miscellaneous Chores

Code Refactoring

8.0.14 (2026-05-21)

Features

Bug Fixes

  • deps: update all non-major dependencies (#22471) (98b8163)
  • dev: handle errors when sending messages to vite server (#22450) (e8e9a34)
  • html: handle trailing slash paths in transformIndexHtml (#22480) (5d94d1b)
  • optimizer: pass oxc jsx options to transformSync in dependency scan (#22342) (b3132da)

Miscellaneous Chores

  • deps: update rolldown-related dependencies (#22470) (7cb728e)
  • remove irrelevant commits from changelog (2c69495)

Code Refactoring

  • glob: do not rewrite import path for absolute base (#22310) (0ae2844)

... (truncated)

Commits

Updates @github/copilot from 1.0.28 to 1.0.63

Release notes

Sourced from @​github/copilot's releases.

1.0.63

2026-06-15

  • Blocked image attachments now explain what to do — enable vision via the "Editor preview features" policy, switch to a vision-capable model, or try a different image — instead of showing a confusing error.
  • Options in --help output sort alphabetically, including options that have two long flags
  • Auth validation errors (e.g., VPN or IP allowlist failures) are now shown in the sign-in banner with guidance to check network access
  • Show fork-based pull requests in /pr and the branch PR badge
  • Resume remote sessions when the local and remote repository names differ only by case
  • Show the spill file path when read_bash output is too large
  • Include recent local sessions in /chronicle standup
  • Restore /responses WebSocket connections
  • Retry transient 401 auth failures in HMAC and OAuth modes
  • Press w in /diff to hide whitespace-only changes
  • Add deferTools option to MCP server config to keep a server's tools always available, even when tool search is enabled
  • Agent mode is tracked per session, so it no longer carries over when you create, clear, or switch sessions
  • Pressing Enter opens the highlighted issue details
  • Plan review menus work on strict OpenAI-compatible backends
  • Prevent Windows crashes when the native runtime addon loads in a corrupted host process heap
  • Recover from unreadable native document attachments by falling back to file-path uploads
  • Keep reverse search aligned in the input footer while you search command history
  • PostToolUse hook matchers (e.g. Edit|Write) are now honored instead of silently dropped, so formatters and linters run only after the tools they target
  • Improve reliability of OpenAI, Anthropic, and Azure OpenAI requests
  • Experimental: /rewind no longer requires git and restores only the files Copilot changed (leaving your own edits intact), with a conversation-only or conversation + files choice

1.0.63-0

Added

  • Press w in /diff to hide whitespace-only changes
  • Add deferTools option to MCP server config to keep a server's tools always available, even when tool search is enabled

Improved

  • Improve reliability of OpenAI, Anthropic, and Azure OpenAI requests
  • Experimental: /rewind no longer requires git and restores only the files Copilot changed (leaving your own edits intact), with a conversation-only or conversation + files choice

Fixed

  • Agent mode is tracked per session, so it no longer carries over when you create, clear, or switch sessions
  • Pressing Enter opens the highlighted issue details
  • Plan review menus work on strict OpenAI-compatible backends
  • Prevent Windows crashes when the native runtime addon loads in a corrupted host process heap
  • Recover from unreadable native document attachments by falling back to file-path uploads
  • Keep reverse search aligned in the input footer while you search command history
  • PostToolUse hook matchers (e.g. Edit|Write) are now honored instead of silently dropped, so formatters and linters run only after the tools they target

1.0.62

2026-06-13

  • Ask and elicitation dialogs now scroll together with the timeline instead of taking over the screen, so a tall dialog no longer hides the agent's output — scroll up to read earlier output, then back down to the dialog
  • Keep blank lines between reasoning summary sections
  • Show user-typed colon terms in the search chip
  • Plugins can now ship extensions, making them installable via the plugin marketplace
  • Add content search, match highlighting, and n/N navigation in diff view

... (truncated)

Changelog

Sourced from @​github/copilot's changelog.

1.0.63 - 2026-06-15

  • Blocked image attachments now explain what to do — enable vision via the "Editor preview features" policy, switch to a vision-capable model, or try a different image — instead of showing a confusing error.
  • Options in --help output sort alphabetically, including options that have two long flags
  • Auth validation errors (e.g., VPN or IP allowlist failures) are now shown in the sign-in banner with guidance to check network access
  • Show fork-based pull requests in /pr and the branch PR badge
  • Resume remote sessions when the local and remote repository names differ only by case
  • Show the spill file path when read_bash output is too large
  • Include recent local sessions in /chronicle standup
  • Restore /responses WebSocket connections
  • Retry transient 401 auth failures in HMAC and OAuth modes
  • Press w in /diff to hide whitespace-only changes
  • Add deferTools option to MCP server config to keep a server's tools always available, even when tool search is enabled
  • Agent mode is tracked per session, so it no longer carries over when you create, clear, or switch sessions
  • Pressing Enter opens the highlighted issue details
  • Plan review menus work on strict OpenAI-compatible backends
  • Prevent Windows crashes when the native runtime addon loads in a corrupted host process heap
  • Recover from unreadable native document attachments by falling back to file-path uploads
  • Keep reverse search aligned in the input footer while you search command history
  • PostToolUse hook matchers (e.g. Edit|Write) are now honored instead of silently dropped, so formatters and linters run only after the tools they target
  • Improve reliability of OpenAI, Anthropic, and Azure OpenAI requests
  • Experimental: /rewind no longer requires git and restores only the files Copilot changed (leaving your own edits intact), with a conversation-only or conversation + files choice

1.0.62 - 2026-06-13

  • Ask and elicitation dialogs now scroll together with the timeline instead of taking over the screen, so a tall dialog no longer hides the agent's output — scroll up to read earlier output, then back down to the dialog
  • Keep blank lines between reasoning summary sections
  • Show user-typed colon terms in the search chip
  • Plugins can now ship extensions, making them installable via the plugin marketplace
  • Add content search, match highlighting, and n/N navigation in diff view
  • Add /app slash command to open the GitHub app or a browser fallback
  • Configure subagent model, reasoning effort, and context tier via user settings or the /subagents (also /agents) picker
  • PowerShell redirect paths no longer trigger content-exclusion refusals
  • WebSocket transport closes cleanly outside the Tokio runtime
  • Shell tool errors now explain when a shell ID was stopped, completed, or reclaimed
  • Voice runtime download dialog no longer reopens in a loop after an install failure
  • Make the MCP server config form easier to use with a picker-based flow
  • Show 'YOLO' (allow all) indicator in the footer and add allow-all state to custom statusLine.command
  • Press / on the Issues or Pull Requests tab to search GitHub with server-side filtering
  • Add session-scoped extensions and canvases
  • Allow SDK clients to configure session memory through session.create and session.resume
  • Automatically authenticate through corporate forward proxies using Kerberos/Negotiate (SPNEGO)
  • Add file tree sidebar and inline comment editor to the /diff view
  • Honor max_output_tokens for BYOK Responses providers
  • MCP server names with dots and slashes map to valid Responses API namespaces
  • Editor commands like code-insiders --wait launch correctly on Windows
  • Load skills from symlinked directories outside the configured root
  • Recover gracefully from oversized inline images instead of failing the turn
  • An image attachment rejected because vision is disabled by policy or unsupported by the current model no longer poisons the rest of the session. The image is stripped from conversation history after the 400 so subsequent prompts succeed.
  • Shells promoted to background from /tasks keep running after the turn ends

... (truncated)

Commits
  • 9776ad4 Update changelog.md for version 1.0.62
  • b91eba5 Update changelog.md for version 1.0.61
  • 85b27cb Update changelog.md for version 1.0.60
  • 3e316bb Update changelog.md for version 1.0.59
  • fbdc9da Update changelog.md for version 1.0.58
  • eaa1eab Update changelog.md for version 1.0.57
  • 5e5b150 Update changelog.md for version 1.0.56
  • 3085447 Update changelog.md for version 1.0.55
  • d88b67d Update changelog.md for version 1.0.54
  • 58e05a5 Update changelog.md for version 1.0.53
  • Additional commits viewable in compare view

Updates ws from 8.20.0 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

  • Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

  • Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits
  • bca91ad [dist] 8.21.0
  • 2b2abd4 [security] Limit retained message parts
  • 78eabe2 [security] Add latest vulnerability to SECURITY.md
  • 5d9b316 [dist] 8.20.1
  • c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
  • ce2a3d6 [ci] Test on node 26
  • 58e45b8 [ci] Do not test on node 25
  • 5f26c24 [ci] Run the lint step on node 24
  • See full diff in compare view

Updates esbuild from 0.27.7 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#4461, #4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#4461, #4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Commits

Updates qs from 6.14.2 to 6.15.2

Changelog

Sourced from qs's changelog.

6.15.2

  • [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
  • [Fix] stringify: use configured delimiter after charsetSentinel (#555)
  • [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
  • [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
  • [Fix] parse: handle nested bracket groups and add regression tests (#530)
  • [readme] fix grammar (#550)
  • [Dev Deps] update @ljharb/eslint-config
  • [Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

  • [Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters
  • [Deps] update @ljharb/eslint-config
  • [Dev Deps] update @ljharb/eslint-config, iconv-lite
  • [Tests] increase coverage

6.15.0

  • [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
  • [Fix] duplicates option should not apply to bracket notation keys (#514)
Commits
  • 9aca407 v6.15.2
  • 5e33d33 [Dev Deps] update @ljharb/eslint-config
  • 21f80b3 [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + `e...
  • a0a81ea [Fix] stringify: use configured delimiter after charsetSentinel
  • e3062f7 [Fix] stringify: apply formatter to encoded key under strictNullHandling
  • 0c180a4 [Fix] stringify: skip null/undefined filter-array entries instead of crashi...
  • 3a8b94a [Tests] add regression tests for keys containing percent-encoded bracket text
  • 96755ab [readme] fix grammar
  • a419ce5 [Fix] parse: handle nested bracket groups and add regression tests
  • 3f5e1c5 v6.15.1
  • Additional commits viewable in compare view

Updates @github/copilot from 1.0.28 to 1.0.63

Release notes

Sourced from @​github/copilot's releases.

1.0.63

2026-06-15

  • Blocked image attachments now explain what to do — enable vision via the "Editor preview features" policy, switch to a vision-capable model, or try a different image — instead of showing a confusing error.
  • Options in --help output sort alphabetically, including options that have two long flags
  • Auth validation errors (e.g., VPN or IP allowlist failures) are now shown in the sign-in banner with guidance to check network access
  • Show fork-based pull requests in /pr and the branch PR badge
  • Resume remote sessions when the local and remote repository names differ only by case
  • Show the spill file path when read_bash output is too large
  • Include recent local sessions in /chronicle standup
  • Restore /responses WebSocket connections
  • Retry transient 401 auth failures in HMAC and OAuth modes
  • Press w in /diff to hide whitespace-only changes
  • Add deferTools option to MCP server config to keep a server's tools always available, even when tool search is enabled
  • Agent mode is tracked per session, so it no longer carries over when you create, clear, or switch sessions
  • Pressing Enter opens the highlighted issue details
  • Plan review menus work on strict OpenAI-compatible backends
  • Prevent Windows crashes when the native runtime addon loads in a corrupted host process heap
  • Recover from unreadable native document attachments by falling back to file-path uploads
  • Keep reverse search aligned in the input footer while you search command history
  • PostToolUse hook matchers (e.g. Edit|Write) are now honored instead of silently dropped, so formatters and linters run only after the tools they target
  • Improve reliability of OpenAI, Anthropic, and Azure OpenAI requests
  • Experimental: /rewind no longer requires git and restores only the files Copilot changed (leaving your own edits intact), with a conversation-only or conversation + files choice

1.0.63-0

Added

  • Press w in /diff to hide whitespace-only changes
  • Add deferTools option to MCP server config to keep a server's tools always available, even when tool search is enabled

Improved

  • Improve reliability of OpenAI, Anthropic, and Azure OpenAI requests
  • Experimental: /rewind no longer requires git and restores only the files Copilot changed (leaving your own edits intact), with a conversation-only or conversation + files choice

Fixed

  • Agent mode is tracked per session, so it no longer carries over when you create, clear, or switch sessions
  • Pressing Enter opens the highlighted issue details
  • Plan review menus work on strict OpenAI-compatible backends
  • Prevent Windows crashes when the native runtime addon loads in a corrupted host process heap
  • Recover from unreadable native document attachments by falling back to file-path uploads
  • Keep reverse search aligned in the input footer while you search command history
  • PostToolUse hook matchers (e.g. Edit|Write) are now honored instead of silently dropped, so formatters and linters run only after the tools they target

1.0.62

2026-06-13

  • Ask and elicitation dialogs now scroll together with the timeline instead of taking over the screen, so a tall dialog no longer hides the agent's output — scroll up to read earlier output, then back down to the dialog
  • Keep blank lines between reasoning summary sections
  • Show user-typed colon terms in the search chip
  • Plugins can now ship extensions, making them installable via the plugin marketplace
  • Add content search, match highlighting, and n/N navigation in diff view

... (truncated)

Changelog

Sourced from @​github/copilot's changelog.

1.0.63 - 2026-06-15

  • Blocked image attachments now explain what to do — enable vision via the "Editor preview features" policy, switch to a vision-capable model, or try a different image — instead of showing a confusing error.
  • Options in --help output sort alphabetically, including options that have two long flags
  • Auth validation errors (e.g., VPN or IP allowlist failures) are now shown in the sign-in banner with guidance to check network access
  • Show fork-based pull requests in /pr and the branch PR badge
  • Resume remote sessions when the local and remote repository names differ only by case
  • Show the spill file path when read_bash output is too large
  • Include recent local sessions in /chronicle standup
  • Restore /responses WebSocket connections
  • Retry transient 401 auth failures in HMAC and OAuth modes
  • Press w in /diff to hide whitespace-only changes
  • Add deferTools option to MCP server config to keep a server's tools always available, even when tool search is enabled
  • Agent mode is tracked per session, so it no longer carries over when you create, clear, or switch sessions
  • Pressing Enter opens the highlighted issue details
  • Plan review menus work on strict OpenAI-compatible backends
  • Prevent Windows crashes when the native runtime addon loads in a corrupted host process heap
  • Recover from unreadable native document attachments by falling back to file-path uploads
  • Keep reverse search aligned in the input footer while you search command history
  • PostToolUse hook matchers (e.g. Edit|Write) are now honored instead of silently dropped, so formatters and linters run only after the tools they target
  • Improve reliability of OpenAI, Anthropic, and Azure OpenAI requests
  • Experimental: /rewind no longer requires git and restores only the files Copilot changed (leaving your own edits intact), with a conversation-only or conversation + files choice

1.0.62 - 2026-06-13

  • Ask and elicitation dialogs now scroll together with the timeline instead of taking over the screen, so a tall dialog no longer hides the agent's output — scroll up to read earlier output, then back down to the dialog
  • Keep blank lines between reasoning summary sections
  • Show user-typed colon terms in the search chip
  • Plugins can now ship extensions, making them installable via the plugin marketplace
  • Add content search, match highlighting, and n/N navigation in diff view
  • Add /app slash command to open the GitHub app or a browser fallback
  • Configure subagent model, reasoning effort, and context tier via user settings or the /subagents (also /agents) picker
  • PowerShell redirect paths no longer trigger content-exclusion refusals
  • WebSocket transport closes cleanly outside the Tokio runtime
  • Shell tool errors now explain when a shell ID was stopped, completed, or reclaimed
  • Voice runtime download dialog no longer reopens in a loop after an install failure
  • Make the MCP server config form easier to use with a picker-based flow
  • Show 'YOLO' (allow all) indicator in the footer and add allow-all state to custom statusLine.command
  • Press / on the Issues or Pull Requests tab to search GitHub with server-side filtering
  • Add session-scoped extensions and canvases
  • Allow SDK clients to configure session memory through session.create and session.resume
  • Automatically authenticate through corporate forward proxies using Kerberos/Negotiate (SPNEGO)
  • Add file tree sidebar and inline comment editor to the /diff view
  • Honor max_output_tokens for BYOK Responses providers
  • MCP server names with dots and slashes map to valid Responses API namespaces
  • Editor commands like code-insiders --wait launch correctly on Windows
  • Load skills from symlinked directories outside the configured root
  • Recover gracefully from oversized inline images instead of failing the turn
  • An image attachment rejected because vision is disabled by policy or unsupported by the current model no longer poisons the rest of the session. The image is stripped from conversation history after the 400 so subsequent prompts succeed.
  • Shells promoted to background from /tasks keep running after the turn ends

... (truncated)

Commits
  • 9776ad4 Update changelog.md for version 1.0.62
  • b91eba5 Update changelog.md for version 1.0.61
  • 85b27cb Update changelog.md for version 1.0.60
  • 3e316bb Update changelog.md for version 1.0.59
  • fbdc9da Update changelog.md for version 1.0.58
  • eaa1eab Update changelog.md for version 1.0.57
  • 5e5b150 Update changelog.md for version 1.0.56
  • 3085447 Update changelog.md for version 1.0.55
  • d88b67d Update changelog.md for version 1.0.54
  • 58e05a5 Update changelog.md for version 1.0.53
  • Additional commits viewable in compare view

Updates vite from 8.0.8 to 8.0.16

Release notes

Sourced from vite's releases.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

v8.0.10

Please refer to CHANGELOG.md for details.

v8.0.9

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.16 (2026-06-01)

Bug Fixes

8.0.15 (2026-06-01)

Features

Bug Fixes

  • capitalize error messages and remove spurious space in parse error (#22488) (85a0eff)
  • deps: update all non-major dependencies (#22511) (2686d7d)
  • dev: fix html-proxy cache key mismatch for /@fs/ HTML paths (#21762) (47c4213)
  • glob: error on relative glob in virtual module when no files match (#22497) (5c8e98f)
  • optimizer: close the rolldown bundle when write() rejects (#22528) (e3cfb9d)
  • resolve: provide onWarn for viteResolvePlugin in JS plugin containers (#22509) (40985f1)

Miscellaneous Chores

Code Refactoring

8.0.14 (2026-05-21)

Features

Bug Fixes

  • deps: update all non-major dependencies (#22471) (98b8163)
  • dev: handle errors when sending messages to vite server (#22450) (e8e9a34)
  • html: handle trailing slash paths in transformIndexHtml (#22480) (5d94d1b)
  • optimizer: pass oxc jsx options to transformSync in dependency scan (#22342) (b3132da)

Miscellaneous Chores

  • deps: update rolldown-related dependencies (#22470) (7cb728e)
  • remove irrelevant commits from changelog (2c69495)

Code Refactoring

  • glob: do not rewrite import path for absolute base (#22310) (0ae2844)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific depen...

Description has been truncated

@dependabot
build(deps): Bump the npm_and_yarn group across 3 directories with 5 …
b595d96 
…updates

Bumps the npm_and_yarn group with 3 updates in the /2.copilotWebRelay directory: [ws](https://github.com/websockets/ws), [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [@github/copilot](https://github.com/github/copilot-cli).
Bumps the npm_and_yarn group with 4 updates in the /2.copilotWebRelay/backend directory: [ws](https://github.com/websockets/ws), [esbuild](https://github.com/evanw/esbuild), [qs](https://github.com/ljharb/qs) and [@github/copilot](https://github.com/github/copilot-cli).
Bumps the npm_and_yarn group with 1 update in the /2.copilotWebRelay/frontend directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `ws` from 8.20.0 to 8.21.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.20.0...8.21.0)

Updates `vite` from 8.0.8 to 8.0.16
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite)

Updates `@github/copilot` from 1.0.28 to 1.0.63
- [Release notes](https://github.com/github/copilot-cli/releases)
- [Changelog](https://github.com/github/copilot-cli/blob/main/changelog.md)
- [Commits](github/copilot-cli@v1.0.28...v1.0.63)

Updates `ws` from 8.20.0 to 8.21.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.20.0...8.21.0)

Updates `esbuild` from 0.27.7 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.27.7...v0.28.1)

Updates `qs` from 6.14.2 to 6.15.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.2...v6.15.2)

Updates `@github/copilot` from 1.0.28 to 1.0.63
- [Release notes](https://github.com/github/copilot-cli/releases)
- [Changelog](https://github.com/github/copilot-cli/blob/main/changelog.md)
- [Commits](github/copilot-cli@v1.0.28...v1.0.63)

Updates `vite` from 8.0.8 to 8.0.16
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite)

---
updated-dependencies:
- dependency-name: ws
  dependency-version: 8.21.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.0.16
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@github/copilot"
  dependency-version: 1.0.63
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.21.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@github/copilot"
  dependency-version: 1.0.63
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.0.16
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 16, 2026
@dependabot dependabot Bot mentioned this pull request Jun 16, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants