[dependabot]

Updated GitHub.Copilot.SDK from 1.0.16 to 1.0.22.

Release notes

Sourced from GitHub.Copilot.SDK's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[DeDuva]

Human review — not merging. GitHub.Copilot.SDK 1.0.16 → 1.0.22, head fa00e35b.

Two independent reasons, and the second is the one that matters.

1. The required CI evidence cannot exist right now. For a change under src/Squad.Agents.AI/** this review requires a SUCCESS from both .NET ubuntu-latest and .NET windows-latest. Neither ran on this head, and they will not run on any head: the Squad.Agents.AI CI workflow (.github/workflows/squad-agents-ai-ci.yml, id 311836631) is currently disabled_manually. dotnet is not installed on this runner either, so there is no local substitute. GitHub still reports this PR mergeable: true, mergeStateStatus: clean — that reflects only claude-md and changes, the two required checks, both of which are shallow by design and say nothing about whether this compiles.

2. This is the split shape .github/dependabot.yml warns about. The config says, in its own words, that GitHub.Copilot.SDK is grouped with Microsoft.Agents.AI* deliberately because "on its own is the shape that breaks" — SquadAgent.cs reaches CopilotClient through MAF, which re-exports it, so the two have to arrive together. This PR bumps the SDK to 1.0.22 while leaving Microsoft.Agents.AI.GitHub.Copilot at 1.22.0. src/Squad.Agents.AI/SquadAgent.cs does using GitHub.Copilot; and holds a CopilotClient field, and the csproj carries GitHub.Copilot.SDK as a direct reference precisely to control that chain.

The config comment accepts this risk on the grounds that "the failure is loud: both .NET jobs go red on CS0012, as they did on #124." That safety net is exactly what is switched off. The loud failure is now a silent one.

#184 already contains this bump in the safe shape — Microsoft.Agents.AI.GitHub.Copilot 1.22.0 → 1.25.0 and GitHub.Copilot.SDK 1.0.16 → 1.0.22 in the same commit. If #184 is the one that gets taken, this PR is redundant and Dependabot will close it.

Nothing to do on this PR itself. The decision for a human is whether to re-enable Squad.Agents.AI CI before any NuGet PR is merged, or to compile these three locally. No code or configuration was changed to get around this.