[dependabot]

Bumps @github/copilot from 1.0.88 to 1.0.96.

Release notes

Sourced from @​github/copilot's releases.

1.0.96

2026-10-12

• Interactive sandbox settings suggest possible environment secrets and let you add masking hosts before saving.
• Make model IDs in /model and /config model case-insensitive and save canonical IDs
• Keep /allow-all available during startup while enterprise policy is still resolving
• /add-dir grants sandbox access to added directories for the current session
• /user list shows the authentication source for each signed-in account
• Show retry progress messages before recovered responses after transient model failures
• Model completions no longer show an authentication warning when an account-owned catalog is unavailable while signed out
• Interactive sessions in git repositories reach the input prompt sooner
• Timeline now shows whether you, Assisted Permissions, policy, or unattended fallback made each permission decision.

1.0.96-2

Fixed

• Make model IDs in /model and /config model case-insensitive and save canonical IDs

1.0.96-1

Added

• Interactive sandbox settings suggest possible environment secrets and let you add masking hosts before saving.

Fixed

• Keep /allow-all available during startup while enterprise policy is still resolving

1.0.96-0

Improved

• Interactive sessions in git repositories reach the input prompt sooner
• Timeline now shows whether you, Assisted Permissions, policy, or unattended fallback made each permission decision.

Fixed

• /add-dir grants sandbox access to added directories for the current session
• /user list shows the authentication source for each signed-in account
• Show retry progress messages before recovered responses after transient model failures
• Model completions no longer show an authentication warning when an account-owned catalog is unavailable while signed out

1.0.95

2026-10-09

• Use native Microsoft Entra broker authentication on macOS when available, with browser fallback.
• copilot config supports sandbox credential injectHosts keys, with key completion in Bash, Zsh, and Fish.
• --context now applies to new and resumed ACP sessions instead of silently using the default or previously saved context tier
• Managed plugin setup retries hourly or after policy changes instead of on every message failure

1.0.95-3

Fixes and changes

1.0.95-2

Fixed

• copilot config supports sandbox credential injectHosts keys, with key completion in Bash, Zsh, and Fish.

... (truncated)

Changelog

Sourced from @​github/copilot's changelog.

1.0.96 - 2026-10-12

• Interactive sandbox settings suggest possible environment secrets and let you add masking hosts before saving.
• Make model IDs in /model and /config model case-insensitive and save canonical IDs
• Keep /allow-all available during startup while enterprise policy is still resolving
• /add-dir grants sandbox access to added directories for the current session
• /user list shows the authentication source for each signed-in account
• Show retry progress messages before recovered responses after transient model failures
• Model completions no longer show an authentication warning when an account-owned catalog is unavailable while signed out
• Interactive sessions in git repositories reach the input prompt sooner
• Timeline now shows whether you, Assisted Permissions, policy, or unattended fallback made each permission decision.

1.0.95 - 2026-10-09

• Use native Microsoft Entra broker authentication on macOS when available, with browser fallback.
• copilot config supports sandbox credential injectHosts keys, with key completion in Bash, Zsh, and Fish.
• --context now applies to new and resumed ACP sessions instead of silently using the default or previously saved context tier
• Managed plugin setup retries hourly or after policy changes instead of on every message failure

1.0.94 - 2026-10-08

• Add Claude Haiku 5.5 to model selection and --model completions
• copilot mcp add recovers cleanly after interrupted MCP config initialization
• MCP enable/disable now works before server discovery without starting MCP servers
• Assisted permissions send visible shell code to the permission judge instead of requiring unnecessary manual approval
• Show a policy warning when startup bypass-permission flags are suppressed by managed settings
• Clicking a Sessions sidebar row now reliably switches sessions during split-view reconciliation
• Show update guidance when managed settings request a newer CLI version without blocking normal prompts
• Managed policy can disable Assisted Permissions and keep sessions in Manual Approval mode.

1.0.93 - 2026-10-07

• Add enterprise permissions.limitTo to enforce managed domain boundaries for network requests
• Run safe /user commands immediately during active turns, reject unsafe remote commands during active turns without opening dialogs, and queue commands advertised by relay hosts
• Plugin skill commands stay available after reloading enabled plugins
• Sandbox local-network allowlists now include localhost and loopback hosts.
• GitHub.com Connector users can expand GitHub CLI permissions in place and retry connections without switching sign-in methods.
• Honor --context long_context at startup and show accurate context allowance in /context
• Connecting a Connector without the required GitHub scope now prompts to update your authorization instead of failing with an authentication error
• Warmed language servers stay running across LSP requests when sandboxing is disabled
• Clicking a truncated compact shell command expands it
• Command sandboxing is available to all users via /sandbox and --sandbox.
• MCP server configuration changes apply between turns without restarting the session.
• Model picker updates the recommended list to prioritize GPT-6.1 Sol, GPT-6 Astra/Luna, and Claude 5.5 models.
• Read user settings only from ~/.copilot/settings.json; user-setting keys in ~/.copilot/config.json are ignored.

1.0.92 - 2026-10-05

• Add copilot config subcommands to list, read, set, and remove settings.
• Add a pre-conversation Ctrl+E environment picker to switch between local and cloud runs

... (truncated)

Commits

• dcdc027 Update changelog.md for version 1.0.95
• a7ae5b0 Update changelog.md for version 1.0.94
• 475c5ba Update changelog.md for version 1.0.93
• 6783c47 Update changelog.md for version 1.0.92
• a9ba11a Update changelog.md for version 1.0.91
• 659e465 Update changelog.md for version 1.0.90
• 8dfa600 Update changelog.md for version 1.0.89
• 57dd244 Update changelog.md for version 1.0.88
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

🟢 Approval recommended

The dependency updates are consistent, with no identified compatibility issues or unresolved findings.

No open issues 🎉

1 file not reviewed

• Actions/package-lock.json: Generated file

What changed in this PR

Updates the Copilot CLI dependency used by AL-Go actions from 1.0.88 to 1.0.96.

Changes:

• Updates the pinned dependency and platform-specific packages.
• Refreshes lockfile integrity hashes and adds Linux glibc/musl metadata.

File	Description
Actions/​package.json	Pins @github/copilot to 1.0.96.
Actions/​package-lock.json	Synchronizes package versions, hashes, and platform metadata.

_{Review effort: Balanced}