[deps-release-notes] copilot-cli — upstream release action items

Rolling upstream release action items — `copilot-cli`

This is the single canonical tracking issue for action items from new copilot-cli releases. The update-awf-version workflow appends a comment here for each version bump going forward — the most recent activity lives in the comments below. This body consolidates everything filed so far.

Latest pinned version covered: 1.0.68

Consolidated history (earliest → latest)

`1.0.48` → `1.0.56` (was #803)

Security: secret scanning covers commit messages + PR descriptions (v1.0.51): Redacts secrets before publishing.
Security: permissions.disableBypassPermissionsMode (v1.0.55): Prevents enabling allow-all/yolo mode; relevant for sandboxed pipelines.
--session-id=<id> flag (v1.0.51): Resume/start sessions with a specific UUID — useful for pipeline correlation.
postToolUse hook additionalContext injected as system message (v1.0.49): Instead of being discarded.
preMcpToolCall hook (v1.0.51): Control outgoing MCP request metadata.
deferred-tool-loading frontmatter for custom agents (v1.0.52): Reduces initial token overhead.
MCP tools with both content + structuredContent surface both (v1.0.56): Review ado-aw MCP tools to ensure dual output is intentional.
Context window tier selection (v1.0.52): Default ~200K vs 1M tokens enforced end-to-end.
Claude Opus 4.8 support (v1.0.55).
Deprecation: oauth.clientId/oauth.callbackPort → oauthClientId/auth.redirectPort (v1.0.52).

`1.0.48` → `1.0.59` (was #843)

Breaking: preToolUse hook errors now deny the tool call (v1.0.57): Previously hook errors silently allowed execution; now they block the call.
Breaking: Remote JSON RPC enabled by default (v1.0.58): Verify this doesn't open unexpected network surface in AWF-sandboxed environments.
Breaking: --plugin-dir skills take precedence over personal-home skills (v1.0.55): Skill resolution order: project > plugin-dir > personal > custom.
ADO-only repos: built-in GitHub MCP server exposes only web_search (v1.0.57): Directly relevant to ado-aw; consider whether the GitHub MCP extension should account for ADO-repository detection.

`1.0.48` → `1.0.60` (was #881)

Alpine Linux (musl libc) support (v1.0.49): Now runs on Alpine-based containers.
Rubber Duck agent enabled by default (v1.0.58): Check whether this adds unexpected turn overhead in automated runs.

`1.0.60` → `1.0.61` (was #951)

Auto-load MCP servers from .github/mcp.json (v1.0.61): ado-aw uses --additional-mcp-config; consider guarding against auto-loading interference.
Claude Fable 5 model support (v1.0.61): Add to validated models in src/engine.rs/docs/engine.md.
mTLS + private-CA for OTLP telemetry (v1.0.61): Added http/protobuf OTLP export via OTel env vars.
Bug fix: grep/glob single-path fix (v1.0.61): Previously missed results with single path argument.
Bug fix: shell validation false positives (v1.0.61): Fixed blocking of harmless commands with words like "kill" in string literals/heredocs.

`1.0.60` → `1.0.62` (was #1002)

Breaking: write_bash interactive input removed (v1.0.62): Shell commands now use lightweight process spawning; interactive input no longer supported. ado-aw exposes write_bash as a first-class tool — assess whether tool surface/docs need updating.
Configure subagent model, reasoning effort, context tier (v1.0.62): Consider surfacing reasoning_effort/context-tier as front-matter fields.
Kerberos/SPNEGO proxy auth (v1.0.62): Auto-auth through corporate forward proxies; relevant for enterprise ADO environments.

`1.0.62` → `1.0.63` (was #1057)

deferTools MCP server config option (v1.0.63): Keeps server tools available even when tool search is enabled. ado-aw could use this for safe-outputs and GitHub MCP servers to prevent them from being filtered out.

`1.0.62` → `1.0.64` (was #1183)

New OTel cache + reasoning token fields (v1.0.64): gen_ai.usage.cache_read.input_tokens, gen_ai.usage.cache_creation.input_tokens, gen_ai.usage.reasoning.output_tokens per GenAI semconv (old underscore-separated names gone). Update src/agent_stats.rs to parse new attribute names.
Static OAuth client overrides for MCP server auth (v1.0.64): ado-aw could expose in MCP server config front-matter.
Autopilot mode auto-handles ask_user, elicitation, sampling, permission prompts (v1.0.64): Reliability improvement for unattended pipeline runs.
Deprecation: report_intent tool removed (v1.0.64): INTERNAL_TOOL_NAMES exclusion in src/agent_stats.rs containing "execute_tool report_intent" is now dead code; can be cleaned up.

`1.0.64` → `1.0.67` (was #1272)

Claude Sonnet 5 model support (v1.0.67): Add to src/engine.rs model allowlist + docs.
Subagent sessions inherit parent tool restrictions (v1.0.67): Security-relevant behavior change; verify against expected security model.
MCP OAuth against Microsoft Entra vanity domain servers (v1.0.67): Fixes AADSTS auth failures for Entra vanity domains; relevant for enterprise Azure AD MCP tools.
copilot skill subcommand (v1.0.65): New /skill alias for listing/adding/removing skills; may be relevant for agency plugin scaffolding.
Deprecation: Claude Opus 4.6 Fast → Claude Opus 4.8 Fast (v1.0.66): Update any ado-aw references to claude-opus-4.6-fast.

`1.0.64` → `1.0.68` (was #1305) — canonical

Breaking: session limits require minimum 30 AI credits (v1.0.67): Pipelines with session-limit: below 30 AI credits will be rejected at runtime. Review compiler defaults.
Claude Opus 4.8 Fast model support (v1.0.66): Add claude-opus-4.8-fast to src/engine.rs allowlist.
kimi-k2.7-code model support (v1.0.68): Add to model allowlist.

Consolidated by the Deps Release-Notes Consolidator workflow. Superseded per-release issues were closed and point here.

Generated by Deps Release-Notes Consolidator · 319.3 AIC · ⌖ 17.7 AIC · ⊞ 6.6K · ◷

`copilot-cli` `1.0.64` → `1.0.69`

Releases analyzed

Breaking changes

Session limits now require a minimum of 30 AI credits (v1.0.67): Require session limits to be at least 30 AI credits — any pipeline using session-limit: with a value below 30 AI credits will be rejected at runtime. Review ado-aw's default session-limit values and add a compile-time validation warning if the configured limit is below 30.

Notable features for ado-aw to adopt

Claude Sonnet 5 model support (v1.0.67): Add Claude Sonnet 5 as a supported model — add claude-sonnet-5 to src/engine.rs model allowlist and docs/engine.md.
Claude Opus 4.8 Fast model support (v1.0.66): Add support for Claude Opus 4.8 Fast — add claude-opus-4.8-fast to ado-aw's model allowlist.
kimi-k2.7-code model support (v1.0.68): Add support for the kimi-k2.7-code model — add kimi-k2.7-code to model allowlist.
Minimal reasoning effort for gemini-3.5-flash (v1.0.69): Add minimal reasoning effort for gemini-3.5-flash — new minimal reasoning effort level for Gemini models; consider surfacing this in ado-aw's engine: front-matter reasoning-effort validation.
copilot skill subcommand (v1.0.65): Add a copilot skill subcommand (and a /skill alias for /skills) — new subcommand for managing skills; relevant for the agency/plugins/ado-aw skill scaffolding and init --agency flow.
web_fetch respects active sandbox network policy (v1.0.69): web_fetch now follows the active sandbox network policy (denying outbound or local targets the policy blocks) — security improvement: web_fetch calls from inside the AWF network sandbox now obey the AWF egress policy. No ado-aw changes needed; this is an automatic security improvement.
Subagent sessions inherit parent tool restrictions (v1.0.67): Subagent sessions keep parent tool restrictions — tool restrictions set on the main agent propagate to spawned subagent sessions. Security-relevant behavior change; verify this aligns with ado-aw's expected security model for detection subagents.

Deprecations

Claude Opus 4.6 Fast deprecated (v1.0.66): deprecate Claude Opus 4.6 Fast — superseded by claude-opus-4.8-fast. Update any ado-aw docs or model references to claude-opus-4.6-fast.

Generated by Dependency Version Updater · 180.6 AIC · ⌖ 14.4 AIC · ⊞ 10.9K · ◷

`copilot-cli` `1.0.69` → `1.0.70`

Releases analyzed

v1.0.70

Notable features for ado-aw to adopt

Plugin SHA pinning: plugins can now be pinned to an exact commit SHA via the sha field in plugin source configuration (v1.0.70). ado-aw's agency/plugins/ado-aw/ scaffolding and init --agency output could benefit from documenting or adopting this for reproducible installs.
Repository-pinned model/effort/deny-lists: a trusted repository can now pin the model, effort level, and context tier, and extend URL/MCP/skill deny lists via .github/copilot/settings.json (v1.0.70). ado-aw's engine: front-matter config overlaps conceptually — worth tracking whether this should inform the compiled pipeline's model-selection logic or how it interacts with COPILOT_CLI_VERSION-pinned installs.
GPT-5.6 model support (v1.0.70): new model available; ado-aw's engine model validation/allowlist in src/engine.rs may need updating to accept gpt-5.6 as a valid model identifier.
preToolUse hooks exiting with code 2 deny tool calls (v1.0.70): new mechanism for blocking specific tool invocations at the hook layer. Could complement ado-aw's existing tool allow-listing in docs/tools.md.
web_fetch works through mandatory HTTPS proxies (v1.0.70): relevant to AWF network-isolated environments where outbound traffic is proxied; may improve reliability of web_fetch calls within ado-aw pipelines.

Generated by Dependency Version Updater · 72.8 AIC · ⌖ 12.3 AIC · ⊞ 10.9K · ◷

`copilot-cli` `1.0.70` → `1.0.71`

Releases analyzed

v1.0.71

Notable features for ado-aw to adopt

Plan mode hard-blocks built-in mutating tool calls — when plan mode is active, the agent can no longer edit files or run mutating shell commands while planning; built-in mutators like opening a pull request are blocked (MCP and external tools are still allowed) (v1.0.71). ado-aw documentation around plan mode behavior should note this stricter enforcement.
Lower default max sub-agent nesting depth from 6 to 4 — subagents.maxDepth default reduced to curb runaway recursive sub-agent delegation; usage-based billing users can still raise it up to 128 (v1.0.71). Agents that rely on deep sub-agent nesting may need their engine.args or agent prompts updated.
plugins marketplace subcommands — new list, add, remove, browse, and update subcommands for managing plugin marketplaces (v1.0.71). The ado-aw init --agency scaffolding or the agency plugin docs may want to mention these.
Persist GitHub MCP toolset/tool config via settings.json (githubMcpToolsets, githubMcpTools, etc.) (v1.0.71). ado-aw's GitHub MCP extension configuration surface may be affected.
Sandbox filesystem policy enforced on LSP file reads and rename edits (v1.0.71). Agents that use LSP tooling in sandbox mode should verify their allowed-path configuration is correct.

Generated by Dependency Version Updater · 93.6 AIC · ⌖ 12.8 AIC · ⊞ 10.9K · ◷

`copilot-cli` `1.0.70` → `1.0.73`

Releases analyzed

Notable features for ado-aw to adopt

Multi-turn subagents always enabled (v1.0.72): Multi-turn subagents are now always on — agents can receive follow-up messages from a running agent turn. ado-aw pipelines that launch subagents via the --allow-tool surface may benefit from this; no configuration change required but the behavior change is worth verifying in Stage 1 runs.
Anthropic subagents continue working when additional directories are configured (v1.0.73): Fixed a regression where subagents backed by Anthropic models would stop working when extra directories were added to the agent context. ado-aw pipelines using Anthropic engines with workspace directory configuration benefit automatically.
Relative links in custom agent instructions resolved from agent file location (v1.0.73): The CLI now resolves relative links inside agent instruction files relative to the agent file's own path. This is relevant to ado-aw's agent file layout — if any agent .md files use relative {{#runtime-import}} or similar relative references, those should now resolve correctly.

Bug fixes (no action needed, automatic)

copilot -p --autopilot no longer hangs when a background shell or agent outlives the turn (v1.0.71): The CLI now correctly honors COPILOT_TASK_WAIT_TIMEOUT_SECONDS in autopilot mode. ado-aw Stage 1 timeout handling benefits automatically.

Generated by Dependency Version Updater · 100 AIC · ⌖ 12.9 AIC · ⊞ 10.9K · ◷

`copilot-cli` `1.0.70` → `1.0.74`

Releases analyzed

Security fixes

copilot skill list strips terminal control characters from skill names/descriptions — a crafted skill could previously inject ANSI escape sequences into the listing output; this is now sanitized. Relevant to ado-aw's skill/plugin catalog listings if they surface copilot-cli output. (v1.0.72)

Notable features for ado-aw to adopt

Open Plugin Spec v1 manifest support + mcp.json configuration — copilot-cli now supports Open Plugin Spec v1 plugin manifests and the mcp.json configuration convention. ado-aw's init --agency scaffolding and agency/plugins/ado-aw/ plugin layout could be updated to emit mcp.json and adopt the new spec format. (v1.0.74)
gemini-3.6-flash model support added — ado-aw's engine model catalog and validation may need to accept gemini-3.6-flash as a valid model identifier. (v1.0.74)
Multi-turn subagents always enabled — subagents can now receive follow-up messages without any opt-in. ado-aw's agent orchestration and Detection stage assumptions about subagent turn behavior may be worth reviewing. (v1.0.72)
/model plan command for plan-mode model selection — plan mode now supports a dedicated model; ado-aw's engine configuration docs could call out plan model options. (v1.0.74)
agentStop hook improvements (forced-continuation detection + 8-turn cap) — agentStop hooks that always block no longer loop indefinitely; hooks receive a stop_hook_active flag. ado-aw's compiled pipelines that configure agentStop hooks should review this behavioral change. (v1.0.72)

Generated by Dependency Version Updater · 108.7 AIC · ⌖ 13.4 AIC · ⊞ 11K · ◷

`copilot-cli` `1.0.70` → `1.0.75`

Releases analyzed

Notable features for ado-aw to adopt

Claude Opus 5 model support (v1.0.75): Add support for Claude Opus 5 — ado-aw may want to document or add Claude Opus 5 as a supported model option in engine config/docs. See v1.0.75.
Open Plugin Spec v1 / mcp.json support (v1.0.74): Add support for Open Plugin Spec v1 plugin manifests and mcp.json configuration — may affect how ado-aw's --additional-mcp-config wiring works or how plugin/skill manifests are authored. See v1.0.74.
Plan mode now hard-blocks built-in mutating tool calls (v1.0.71): Plan mode now hard-blocks built-in tool calls that would modify the workspace — if ado-aw surfaces plan mode to users or documents it, this behavioral change should be noted. See v1.0.71.
Multi-turn subagents always enabled (v1.0.72): Multi-turn subagents are always enabled, so you can send follow-up messages to running agents — could affect ado-aw's subagent configuration surface. See v1.0.72.
Sandbox macOS keychain access now defaults off (v1.0.72): Sandbox macOS keychain access now defaults off for tighter isolation — sandboxing defaults have changed; review if ado-aw's AWF sandbox config needs alignment. See v1.0.72.
Default sandbox opt-in splash / first-run (v1.0.74): Show a first-run splash to opt into the default sandbox — new interactive flow; verify ado-aw's non-interactive --no-ask-user pipeline usage is unaffected or adjust blocked-args. See v1.0.74.
Max sub-agent nesting depth lowered from 6 to 4 (v1.0.71): Lower the default maximum sub-agent nesting depth from 6 to 4 — if ado-aw docs or templates rely on deep subagent nesting, they should be updated. See v1.0.71.

Deprecations

copilot -p --autopilot hang fix (v1.0.71): The previous behaviour where copilot -p --autopilot could hang when a background shell or agent outlived the turn is now fixed; ado-aw pipeline invocations using --autopilot in non-interactive mode should now be reliable. See v1.0.71.

Generated by Dependency Version Updater · 75 AIC · ⌖ 12.1 AIC · ⊞ 11K · ◷

`copilot-cli` `1.0.70` → `1.0.76`

Releases analyzed

v1.0.71 (notes unavailable in fetched list)
v1.0.72 (notes unavailable in fetched list)
v1.0.73
v1.0.74
v1.0.75
v1.0.76

Notable features for ado-aw to adopt

Enterprise sandbox floor enforcement: Enterprise administrators can now enforce a restrictive sandbox floor via managed settings that tighten (but never loosen) users' sandbox policies; the /sandbox dialog surfaces org-configured values with locked fields. ado-aw's documentation on sandbox configuration and enterprise policy may want to note this capability. (v1.0.76)
Open Plugin Spec v1 support: Added support for Open Plugin Spec v1 plugin manifests and mcp.json configuration, enabling a standardized plugin authoring format that ado-aw's plugin tooling could leverage. (v1.0.74)
New model support: Claude Opus 5 added in v1.0.75; grok-4.5 and gemini-3.6-flash added in v1.0.74/v1.0.76. ado-aw's engine model catalog (docs/engine.md) may need updating to reflect these new options.
web_fetch sandbox policy fix: web_fetch now correctly denies egress when network.allowOutbound is false and a proxy is configured — a proxy no longer silently overrides the user's outbound sandbox policy. Relevant for ado-aw pipelines that configure outbound network restrictions. (v1.0.76)

Generated by Dependency Version Updater · 103.7 AIC · ⌖ 13.7 AIC · ⊞ 11.1K · ◷

`copilot-cli` `1.0.70` → `1.0.77`

Releases analyzed

Breaking changes

v1.0.71: Default max sub-agent nesting depth lowered from 6 to 4. ado-aw agents with deep recursive sub-agent chains may behave differently; subagents.maxDepth can be raised up to 128 if needed. (v1.0.71)
v1.0.71: Plan mode now hard-blocks built-in tool calls that would modify the workspace — agents can no longer edit files or run mutating shell commands while planning. This is a behaviour change for any ado-aw workflow that relies on plan mode + file edits in the same step. (v1.0.71)
v1.0.72: macOS sandbox keychain access now defaults to off for tighter isolation. Agents that previously relied on keychain access will need it explicitly re-enabled. (Likely low impact for ado-aw which runs on Linux ADO agents, but worth noting.) (v1.0.72)

Security fixes

v1.0.72: copilot skill list now strips terminal control characters from skill names/descriptions, preventing a crafted skill from injecting ANSI escape sequences into CLI output. (v1.0.72)
v1.0.76: URL permission prompts now always surface the sandbox-bypass warning and the model's reason when a host integration rebuilds the prompt — an elevated fetch can no longer be displayed as an ordinary one. (v1.0.76)
v1.0.76: web_fetch now routes through the configured sandbox proxy and denies egress when network.allowOutbound is false — a proxy can no longer override the user's outbound policy. (v1.0.76)
v1.0.77: "Unconditional autopilot approval now disables sandbox for the current session when bypass is allowed" — sandbox bypass semantics clarified; ado-aw workflows using autopilot mode should verify this matches intended isolation posture. (v1.0.77)
v1.0.77: Enterprise administrators can now enforce managed sandbox policy via macOS and Windows native MDM settings. (v1.0.77)

Notable features for ado-aw to adopt

v1.0.74: Open Plugin Spec v1 plugin manifests and mcp.json configuration are now supported. ado-aw's mcp-author plugin scaffold and init --agency templates could be updated to emit OPS-v1-compatible manifests. (v1.0.74)
v1.0.75: Claude Opus 5 is now supported. ado-aw's engine: model documentation and catalog should list it as an available model. (v1.0.75)
v1.0.76: grok-4.5 model is now supported. ado-aw's model catalog should be updated. (v1.0.76)
v1.0.77: Reasoning effort can now be omitted so the server selects the default. ado-aw's engine.reasoning-effort front-matter field documentation should note this is now optional (server default applies when omitted). (v1.0.77)

Generated by Dependency Version Updater · 98 AIC · ⌖ 12.7 AIC · ⊞ 11.1K · ◷

`copilot-cli` `1.0.70` → `1.0.78`

Releases analyzed

Breaking changes

Plan mode now hard-blocks built-in tool calls that would modify the workspace (v1.0.71): the agent can no longer edit files or run mutating shell commands while planning (built-in mutators like opening a pull request are blocked; MCP/external tools still allowed). Relevant if any ado-aw prompt flow relies on plan-mode side effects.
sessionEnd hook semantics changed for piped/stdin prompts (v1.0.78): a run whose prompt is piped over stdin now fires sessionEnd once per completed agent turn with reason: complete/error, instead of once at shutdown with user_exit. ado-aw pipes prompts to the CLI non-interactively — if any tooling depends on the old single-shutdown-hook behavior, it needs updating.
Managed-settings fetch failure now fails open, not closed (v1.0.78): when a server-managed settings fetch fails (network error, non-2xx, malformed response) and no cached policy is usable, the CLI now starts without the unconfirmed server restriction rather than refusing to start. Worth confirming this doesn't weaken any managed-settings assumptions ado-aw relies on for sandboxed pipeline runs.

Security fixes

copilot skill list strips terminal control characters (v1.0.72): a crafted skill name/description can no longer inject ANSI escape sequences into listing output — relevant since ado-aw scaffolds skills via init/agency plugin.
Hook output now bounded at 10 MiB per invocation (v1.0.76): part of a broader hardening of userPromptSubmitted hook handling (invalid non-string modifiedPrompt/responseContent values are now ignored with a warning instead of corrupting the session; null additionalContext treated as absent) — prevents an HTTP/command hook from exhausting memory.
Sandbox filesystem policy now enforced on LSP file reads and rename edits (v1.0.71).
Sandbox denied paths enforced for relative and symlinked entries on macOS/Linux (v1.0.76) — closes a path-traversal-style gap in the sandbox denylist (Windows cannot deny per path).

Notable features for ado-aw to adopt

Grok-4.5, Claude Opus 5, gemini-3.6-flash model support (v1.0.74, v1.0.75, v1.0.76): consider adding to the model allowlist in src/engine.rs/docs/engine.md.
Open Plugin Spec v1 plugin manifests and mcp.json configuration support (v1.0.74): relevant to the agency plugin (agency/plugins/ado-aw/) which already wires an .mcp.json.
New sandbox setting allowDevToolCaches (v1.0.78, on by default): grants sandboxed builds access to toolchain caches/registries/installs. Worth checking interplay with AWF's own network-isolation model for ado-aw's runtimes (Python/Node/.NET/Lean).
web_fetch respects network.allowOutbound and routes through the configured sandbox proxy (v1.0.76): may be relevant to how ado-aw documents/expects outbound network behavior inside the AWF sandbox.
Opt-in git and gh authentication inside the OS sandbox (v1.0.72).
/permissions command to switch approval modes; the /allow-all auto safety-judge model is no longer user-configurable (v1.0.78) — the judge model selection is now automatic, which may affect any documentation referencing bypass/allow-all behavior.
Enterprise-enforced restrictive sandbox floor via managed settings (v1.0.76): managed settings can tighten (never loosen) the sandbox policy — relevant to docs/network.md's AWF sandbox model discussion.

Deprecations

None called out explicitly in this range; the /allow-all judge-model configurability removal (v1.0.78, noted above) is effectively a deprecation of that user-facing knob.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · aut00 · 89.7 AIC · ⌖ 12.5 AIC · ⊞ 16.1K · ◷

`copilot-cli` `1.0.70` → `1.0.78`

Releases analyzed

v1.0.78

Notable features for ado-aw to adopt

Tool-call duration timeline headers — the CLI now surfaces per-tool-call timing in its output headers. ado-aw's engine invocation / OTel agent-stats parsing (src/agent_stats.rs) could potentially surface this for richer audit/trace reporting (ado-aw audit, ado-aw trace).
Plugin auto-update at session start — the CLI now checks and applies plugin updates automatically when a session starts. Worth confirming this doesn't introduce unexpected network calls inside AWF's network-isolated sandbox during the Agent stage; if plugin auto-update requires network access, it may need an AWF allowlist entry or an explicit disable flag in ado-aw's engine: invocation.
/new-worktree experimental command — new git-worktree-based session isolation command. Not directly relevant to ado-aw's non-interactive pipeline usage today, but worth tracking if worktree isolation becomes useful for multi-branch agent runs.
ACP token usage exposure — Agent Communication Protocol now exposes token usage data. Could be surfaced in ado-aw audit's OTel/token-usage reporting.
forceRemoteSettingsRefresh managed setting — new managed setting to force a refresh of remote settings. May be relevant to how ado-aw configures engine.args/engine.env for managed/enterprise deployments.

Deprecations / behavior changes worth flagging

Browser-flow login default change for local/no-TTY sessions — the default authentication flow changed for sessions without a TTY. ado-aw's compiled pipelines run the Copilot CLI non-interactively inside ADO agents (no TTY), so this default change could affect how auth is established in the Agent job; worth verifying the current github-app-token/token-passthrough mechanism (scripts/ado-script/src/github-app-token/) is unaffected.
sessionEnd hook firing semantics change for piped stdin runs — the conditions under which the sessionEnd hook fires changed when input is piped via stdin, which is how ado-aw feeds prompts to the engine. Worth double-checking that any hook-dependent cleanup/telemetry in the Agent job still fires as expected.
Sandbox bypass scoping narrowed to session-only and managed-settings fail-open fallback behavior — both relate to sandboxing/managed-settings enforcement. Worth confirming these don't change how engine: invokes the CLI inside the AWF sandbox in ado-aw's Agent stage.

No CVE/security-advisory-labeled fixes were called out explicitly in this release's notes; no items in this range were classified as hard breaking changes, though several of the above behavior changes are worth a deliberate compatibility check on the next COPILOT_CLI_VERSION bump PR.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · aut00 · 131.4 AIC · ⌖ 12.9 AIC · ⊞ 16.1K · ◷

`copilot-cli` `1.0.70` → `1.0.79`

Releases analyzed

Breaking changes

Sandbox auth settings key rename, no migration (v1.0.79): sandbox.gitAuth/sandbox.ghAuth moved to sandbox.auth.git/sandbox.auth.gh. Old keys are silently ignored in settings files, and SDK requests still sending them are now rejected as invalid rather than ignored. Any ado-aw docs/tooling referencing the old keys should be updated.
--worktree default start ref changed (v1.0.79): the new worktreeBaseRef setting controls whether /worktree, /worktree new, and --worktree start from HEAD or the remote default branch; all three now default to HEAD (previously --worktree defaulted to the remote default branch).

Security fixes

Opt-in git/gh auth inside the OS sandbox; macOS keychain access now defaults off (v1.0.72): tightens default sandbox isolation — re-enabling requires explicit /sandbox opt-in.
Plan mode hard-blocks mutating built-in tool calls (v1.0.71): the agent can no longer edit files or run mutating shell commands while planning; relevant to ado-aw's sandboxed agent execution model.

Notable features for ado-aw to adopt

tgrep replaces ripgrep for large monorepos (v1.0.79): trigram-indexed search for faster regex search in large codebases — transparent to ado-aw but worth noting for perf-sensitive agent runs.
Tool-call duration timeline headers (v1.0.78): per-tool-call timing surfaced in CLI output (/settings showToolDurations); could be useful context for ado-aw audit/agent stats parsing if surfaced in structured output.
grok-4.5 model support (v1.0.76): new model available; consider adding to any ado-aw model allowlist/docs.
Browser-based (web) OAuth login flow, now default on local interactive terminals (v1.0.77): --web-flow/--device-code flags select the mode explicitly; remote/headless environments (matching ado-aw's sandboxed pipeline runs) continue to default to device code, so no expected impact on compiled pipelines, but worth confirming.

Deprecations

None called out in this release range.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 97 AIC · ⌖ 16.4 AIC · ⊞ 16.2K · ◷

`copilot-cli` `1.0.70` → `1.0.80`

Releases analyzed

Breaking changes

BREAKING: the sandbox setting allowDevToolCaches (added in v1.0.78) was renamed allowDevToolAccess in v1.0.79. The old key is silently ignored, so an existing false opt-out in a pinned config would revert to the default (on). If ado-aw ever emits or documents this key in generated engine config/sandbox settings, it must be updated to allowDevToolAccess.
The sandbox.gitAuth/sandbox.ghAuth settings keys moved to sandbox.auth.git/sandbox.auth.gh with no migration — old keys are ignored in settings files, and SDK requests still sending them are rejected as invalid (v1.0.79).
Managed settings now fail open (start without the unconfirmed server restriction) when no cached policy is available, a change from the prior fail-closed behavior (v1.0.78) — relevant if ado-aw relies on managed/enterprise sandbox policy enforcement being fail-closed.

Notable features for ado-aw to adopt

New sandbox setting allowDevToolCaches/allowDevToolAccess (on by default) grants sandboxed builds access to toolchain caches, registries, and installs without extra setup (v1.0.78) — could reduce bespoke network-allowlist workarounds ado-aw currently needs for ecosystem package managers inside the AWF sandbox.
Sandboxed git now authenticates to Azure DevOps, GitHub Enterprise Server, GitLab, and other non-GitHub remotes with stored HTTPS credentials (v1.0.79) — directly relevant to ado-aw's Azure DevOps git remote/repos support.
/sandbox policy command shows effective sandbox paths, denials, and network access (v1.0.79) — could aid debugging AWF/sandbox interaction issues documented in the runner-doctor style docs.
Enterprise-managed sandbox policy can now enforce a proxy URL while credentials remain user-controlled (v1.0.79).
Sandbox denied paths are now enforced for relative and symlinked entries on macOS and Linux (v1.0.76).

Deprecations

/theme's deprecation notice behavior was refined but no new deprecations were announced in this range.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Dependency Version Updater · auto · 121.3 AIC · ⌖ 5.1 AIC · ⊞ 16.5K · ◷

Consolidated into the canonical rolling issue #2041 ( [deps-release-notes] copilot-cli — upstream release action items ). Its action items have been preserved there.

Generated by Deps Release-Notes Consolidator · auto · 76.3 AIC · ⌖ 11.6 AIC · ⊞ 10.6K

[deps-release-notes] copilot-cli — upstream release action items #1305

Description

Rolling upstream release action items — copilot-cli

Consolidated history (earliest → latest)

1.0.48 → 1.0.56 (was #803)

1.0.48 → 1.0.59 (was #843)

1.0.48 → 1.0.60 (was #881)

1.0.60 → 1.0.61 (was #951)

1.0.60 → 1.0.62 (was #1002)

1.0.62 → 1.0.63 (was #1057)

1.0.62 → 1.0.64 (was #1183)

1.0.64 → 1.0.67 (was #1272)

1.0.64 → 1.0.68 (was #1305) — canonical

Activity

github-actions commented on Jul 8, 2026

copilot-cli 1.0.64 → 1.0.69

Releases analyzed

Breaking changes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Jul 10, 2026

copilot-cli 1.0.69 → 1.0.70

Releases analyzed

Notable features for ado-aw to adopt

github-actions commented on Jul 16, 2026

copilot-cli 1.0.70 → 1.0.71

Releases analyzed

Notable features for ado-aw to adopt

github-actions commented on Jul 21, 2026

copilot-cli 1.0.70 → 1.0.73

Releases analyzed

Notable features for ado-aw to adopt

Bug fixes (no action needed, automatic)

github-actions commented on Jul 24, 2026

copilot-cli 1.0.70 → 1.0.74

Releases analyzed

Security fixes

Notable features for ado-aw to adopt

github-actions commented on Jul 25, 2026

copilot-cli 1.0.70 → 1.0.75

Releases analyzed

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Jul 30, 2026

copilot-cli 1.0.70 → 1.0.76

Releases analyzed

Notable features for ado-aw to adopt

github-actions commented on Jul 31, 2026

copilot-cli 1.0.70 → 1.0.77

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

github-actions commented on Aug 4, 2026

copilot-cli 1.0.70 → 1.0.78

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Aug 5, 2026

copilot-cli 1.0.70 → 1.0.78

Releases analyzed

Notable features for ado-aw to adopt

Deprecations / behavior changes worth flagging

github-actions commented on Aug 11, 2026

copilot-cli 1.0.70 → 1.0.79

Releases analyzed

Breaking changes

Security fixes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Aug 14, 2026

copilot-cli 1.0.70 → 1.0.80

Releases analyzed

Breaking changes

Notable features for ado-aw to adopt

Deprecations

github-actions commented on Aug 29, 2026

Metadata

Rolling upstream release action items — `copilot-cli`

`1.0.48` → `1.0.56` (was #803)

`1.0.48` → `1.0.59` (was #843)

`1.0.48` → `1.0.60` (was #881)

`1.0.60` → `1.0.61` (was #951)

`1.0.60` → `1.0.62` (was #1002)

`1.0.62` → `1.0.63` (was #1057)

`1.0.62` → `1.0.64` (was #1183)

`1.0.64` → `1.0.67` (was #1272)

`1.0.64` → `1.0.68` (was #1305) — canonical

`copilot-cli` `1.0.64` → `1.0.69`

`copilot-cli` `1.0.69` → `1.0.70`

`copilot-cli` `1.0.70` → `1.0.71`

`copilot-cli` `1.0.70` → `1.0.73`

`copilot-cli` `1.0.70` → `1.0.74`

`copilot-cli` `1.0.70` → `1.0.75`

`copilot-cli` `1.0.70` → `1.0.76`

`copilot-cli` `1.0.70` → `1.0.77`

`copilot-cli` `1.0.70` → `1.0.78`

`copilot-cli` `1.0.70` → `1.0.78`

`copilot-cli` `1.0.70` → `1.0.79`

`copilot-cli` `1.0.70` → `1.0.80`