[dependabot]

Updated GitHub.Copilot.SDK from 1.0.16 to 1.0.28.

Release notes

Sourced from GitHub.Copilot.SDK's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[DeDuva]

Human review needed — not merging. GitHub.Copilot.SDK 1.0.16 → 1.0.28 in src/Squad.Agents.AI, head 5a473b8b. The diff is clean and dependency-only: a single PackageReference Version on one line of Squad.Agents.AI.csproj. The problem is that nothing validated it, and in this particular shape that matters more than usual.

No validation evidence exists, and none can be produced right now.

• dotnet is not installed on this runner, so local validation per the review doc's NuGet path was unavailable.
• CI did not compile this change either. Squad.Agents.AI CI — the workflow that owns the .NET ubuntu-latest and .NET windows-latest jobs — is disabled_manually. No .NET check appears on this PR's head at all.
• The eight checks that did report (test, sdk-exports-validation, samples-build, duva-bench-stats, Policy Gates, changes, claude-md, and a skipped docs-quality) are the npm/TypeScript side of the tree. None of them touch src/Squad.Agents.AI. mergeStateStatus: CLEAN here means "the two required shallow checks passed", not "this package still builds".

This is specifically the shape .github/dependabot.yml warns about. That file groups GitHub.Copilot.SDK into both Microsoft groups on purpose, because src/Squad.Agents.AI/SquadAgent.cs takes using GitHub.Copilot; and holds a CopilotClient directly while also reaching it through Microsoft.Agents.AI.GitHub.Copilot, which re-exports it — so the two have to arrive together to compile. The config's own comment accepts that a solo SDK bump can still appear, on the explicit grounds that "the failure is loud: both .NET jobs go red on CS0012, as they did on #124."

That safety net is gone. With Squad.Agents.AI CI disabled, a solo GitHub.Copilot.SDK bump that breaks the MAF pairing now merges silently green. This PR is exactly that bump (it moves the SDK and leaves Microsoft.Agents.AI.GitHub.Copilot at 1.22.0), and #200 is its mirror image — moving MAF to 1.27.0 while leaving the SDK at 1.0.16. Neither can be checked by the repository as currently configured.

Recommended next action (nothing was changed here). Re-enable Squad.Agents.AI CI before landing any NuGet PR; it is the only thing in this repository that compiles this package, and the Dependabot grouping strategy is documented as depending on it. Until then these updates need a local dotnet restore && dotnet build && dotnet test on a machine with the .NET 10 SDK. Worth deciding alongside #198, which carries this same SDK bump together with the MAF 1.27.0 bump — i.e. the pairing that the config says is the combination that actually compiles.