Bump @github/copilot-sdk from 1.0.4 to 1.0.5 in /actions/setup/js

[dependabot]

Bumps @github/copilot-sdk from 1.0.4 to 1.0.5.

Release notes

Sourced from @​github/copilot-sdk's releases.

GitHub Copilot SDK for Java 1.0.5

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central](https://github.com/github/copilot-sdk/blob/HEAD/(central.sonatype.com/redacted)

📖 [Documentation](https://github.com/github/copilot-sdk/blob/HEAD/(github.github.io/redacted) · [Javadoc](https://github.com/github/copilot-sdk/blob/HEAD/(github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.5</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.5")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.5'

---

Feature: annotation-based tool API (@CopilotTool)

The Java SDK now includes a high-level, annotation-driven tool API. Annotate methods with @CopilotTool and parameters with @CopilotToolParam to define tools — a JSR-269 annotation processor generates metadata at compile time with no runtime reflection. Use ToolDefinition.fromObject() to register tools with minimal boilerplate. (#1792)

public class WeatherTools {
    `@CopilotTool`("Get the current weather for a given city")
    public String getWeather(
            `@CopilotToolParam`(value = "The city to get weather for", required = true) String city,
            `@CopilotToolParam`(value = "Temperature unit: celsius or fahrenheit", defaultValue = "celsius") String unit) {
        // implementation
    }
}
List<ToolDefinition> tools = ToolDefinition.fromObject(new WeatherTools());
SessionConfig config = new SessionConfig().setTools(tools);

Feature: ToolInvocation injection in @CopilotTool methods

... (truncated)

Changelog

Sourced from @​github/copilot-sdk's changelog.

v1.0.5 (2026-07-01)

Feature: MCP OAuth host token handlers

SDK applications can now handle OAuth challenges from MCP servers that require host-provided authentication. Register an onMcpAuthRequest callback on the session config and the SDK will invoke it whenever an MCP server responds with a 401 WWW-Authenticate challenge; return an access token (or cancel the request). Supports initial auth, refresh, reauth, and upscope flows across all SDKs. (#1669)

const session = await client.createSession({
    onMcpAuthRequest: async (request) => ({
        accessToken: await myIdentityProvider.getToken(request.serverUrl),
    }),
});

var session = await client.CreateSessionAsync(new SessionConfig
{
    OnMcpAuthRequest = async ctx =>
        McpAuthResult.FromToken(new McpAuthToken
        {
            AccessToken = await myIdentityProvider.GetTokenAsync(ctx.ServerUrl)
        }),
});

Feature: session options for citations, excluded agents, and spending limits

Three additional session configuration options are now available across all SDKs. (#1865)

const session = await client.createSession({
    enableCitations: true,
    excludedBuiltinAgents: ["github-search"],
    sessionLimits: { maxAiCredits: 10 },
});

var session = await client.CreateSessionAsync(new SessionConfig
{
    EnableCitations = true,
    ExcludedBuiltInAgents = ["github-search"],
    SessionLimits = new SessionLimitsConfig { MaxAiCredits = 10 },
});

Other changes

• improvement: [All SDKs] rename BYOK callback field getBearerToken → bearerTokenProvider; add sessionId to ProviderTokenArgs for per-session token scoping (#1796)
• bugfix: [Node] fix MCP OAuth registerInterest sent before session.resume, causing "Session not found" errors when resuming a session with onMcpAuthRequest (#1861)

... (truncated)

Commits

• 62ffcfe docs: add session limits guidance (#1856)
• 1047dfb docs: update billing information for GitHub Copilot SDK usage (#1854)
• cbc3026 Fix MCP OAuth resume order in Node.js SDK (#1861)
• 64dcd25 Expose new session options across SDKs (#1865)
• b168366 Update @​github/copilot to 1.0.67 (#1860)
• cc66206 Update @​github/copilot to 1.0.66 (#1859)
• 6189f84 [maven-release-plugin] prepare for next development iteration
• 5657aab [maven-release-plugin] prepare release java/v1.0.5
• d98a6c5 docs: update version references to 1.0.5
• 91eaa4b Add MCP OAuth lifecycle SDK support (#1669)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🛠️ Agentic Maintenance updated this pull request branch.

View workflow run

[gh-aw-bot]

@copilot please run the pr-finisher skill, address unresolved review comments, and rerun checks once the branch is up to date.

Generated by 👨‍🍳 PR Sous Chef · 11.9 AIC · ⌖ 7.75 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot please run the pr-finisher skill, address unresolved review comments, and rerun checks once the branch is up to date.

...

Done. The branch was already up to date (merge commit in place). Local validation results:

• ✅ make fmt — no changes needed
• ✅ make lint — passes (pre-existing warnings only, no errors)
• ✅ make test-unit — wasm golden files had drifted after the main merge; regenerated via make update-wasm-golden and all tests now pass
• ✅ No unresolved review threads

Pushed commit chore: regenerate wasm golden files after main merge. CI must be re-triggered by a maintainer (close/reopen or workflow_dispatch) to confirm the full suite against the new HEAD.

[gh-aw-bot]

@copilot please run the pr-finisher skill, address unresolved review comments, and rerun checks once the branch is up to date.

Generated by 👨‍🍳 PR Sous Chef · 4.03 AIC · ⌖ 8.11 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.