[dependabot]

Bumps the all group with 3 updates: github.com/github/copilot-sdk/go, github.com/openai/openai-go/v3 and google.golang.org/genai.

Updates github.com/github/copilot-sdk/go from 1.0.26 to 1.0.28

Release notes

Sourced from github.com/github/copilot-sdk/go's releases.

v1.0.28

Other changes

• improvement: update SDK snapshot for Copilot CLI 1.0.105-1

Full Changelog: github/copilot-sdk@v1.0.27...v1.0.28

[!WARNING]

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by Release Notes Generator · copilot · auto · 16.8 AIC · ⌖ 0.554 AIC · ⊞ 4.3K

v1.0.28-preview.0

Other changes

• improvement: updated SDK snapshot to Copilot CLI 1.0.105-1, refreshing generated session event types across all SDKs (TypeScript, C#, Go, Python, Java, Rust), with small adjustments to permission request and elicitation handling in the Go, Java, Node.js, Python, and .NET SDKs

Full Changelog: github/copilot-sdk@v1.0.27...v1.0.28-preview.0

[!WARNING]

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

... (truncated)

Commits

• fa108e7 Update SDK snapshot for Copilot CLI 1.0.105
• 9bc718c Update SDK snapshot for Copilot CLI 1.0.105-1
• 2653688 Update SDK snapshot for Copilot CLI 1.0.104-4
• c57638f Update SDK snapshot for Copilot CLI 1.0.104-3
• be9764f Update SDK snapshot for Copilot CLI 1.0.104-2
• 5386758 Update SDK snapshot for Copilot CLI 1.0.104-1
• ca1103f Update SDK snapshot for Copilot CLI 1.0.104-0
• See full diff in compare view

Updates github.com/openai/openai-go/v3 from 3.88.0 to 3.90.0

Release notes

Sourced from github.com/openai/openai-go/v3's releases.

v3.90.0

3.90.0 (2026-10-28)

Features

• api: add image and web search usage to responses (#1179) (59cb4a5)
• api: add organization external key management (#1180) (bcf55b4)
• api: filter agent sessions by metadata (#1178) (0819c8b)

Bug Fixes

• examples: check each WebSocket response before continuing (#1161) (2638013)

Chores

• api: document upcoming model shutdowns (#1177) (af9a64a)
• api: update image-model documentation (#1175) (071de86)
• enforce generated-file ownership (#1169) (8bfabbe)

v3.89.0

3.89.0 (2026-10-27)

Features

• api: add prompt cache breakpoint TTL options (#1162) (51a5817)

Bug Fixes

• api: isolate decoded null collections (#1159) (898671b)
• api: preserve existing response and decision input behavior (#1158) (0bd7238)

Chores

• api: alphabetize the shared type index (#1163) (d32fa05)
• enforce strict generated-file ownership (#1165) (2bd28ff)
• set custom-code budget to zero (#1164) (9d77839)

Build System

• deps: bump actions/create-github-app-token from 3.2.0 to 3.3.0 (#1139) (67bcaaf)
• deps: bump actions/download-artifact from 8.0.1 to 8.0.2 (#1101) (b2b294f)
• deps: bump actions/setup-node from 7.0.0 to 7.1.0 (#1102) (c3a3c9a)
• deps: bump actions/upload-artifact from 7.0.1 to 7.0.2 (#1100) (17caf9b)

... (truncated)

Changelog

Sourced from github.com/openai/openai-go/v3's changelog.

3.90.0 (2026-10-28)

Features

• api: add image and web search usage to responses (#1179) (59cb4a5)
• api: add organization external key management (#1180) (bcf55b4)
• api: filter agent sessions by metadata (#1178) (0819c8b)

Bug Fixes

• examples: check each WebSocket response before continuing (#1161) (2638013)

Chores

• api: document upcoming model shutdowns (#1177) (af9a64a)
• api: update image-model documentation (#1175) (071de86)
• enforce generated-file ownership (#1169) (8bfabbe)

3.89.0 (2026-10-27)

Features

• api: add prompt cache breakpoint TTL options (#1162) (51a5817)

Bug Fixes

• api: isolate decoded null collections (#1159) (898671b)
• api: preserve existing response and decision input behavior (#1158) (0bd7238)

Chores

• api: alphabetize the shared type index (#1163) (d32fa05)
• enforce strict generated-file ownership (#1165) (2bd28ff)
• set custom-code budget to zero (#1164) (9d77839)

Build System

• deps: bump actions/create-github-app-token from 3.2.0 to 3.3.0 (#1139) (67bcaaf)
• deps: bump actions/download-artifact from 8.0.1 to 8.0.2 (#1101) (b2b294f)
• deps: bump actions/setup-node from 7.0.0 to 7.1.0 (#1102) (c3a3c9a)
• deps: bump actions/upload-artifact from 7.0.1 to 7.0.2 (#1100) (17caf9b)
• deps: bump github.com/aws/aws-sdk-go-v2/config in / (#1098) (e8374d1)
• deps: bump the codeql group across 1 directory with 2 updates (#1099) (a97ac6d)

Commits

• a9fc372 chore: release main (#1171)
• bcf55b4 feat(api): add organization external key management (#1180)
• 59cb4a5 feat(api): add image and web search usage to responses (#1179)
• 0819c8b feat(api): filter agent sessions by metadata (#1178)
• 2638013 fix(examples): check each WebSocket response before continuing (#1161)
• af9a64a chore(api): document upcoming model shutdowns (#1177)
• 071de86 chore(api): update image-model documentation (#1175)
• 8bfabbe chore: enforce generated-file ownership (#1169)
• 78c965f chore: release main (#1160)
• 2bd28ff chore: enforce strict generated-file ownership (#1165)
• Additional commits viewable in compare view

Updates google.golang.org/genai from 1.76.0 to 1.77.0

Release notes

Sourced from google.golang.org/genai's releases.

v1.77.0

1.77.0 (2026-10-29)

Features

• Add support for continuation_token and requires_continuation status (51d761f)
• add video upscale task parameter (cab8bf7)
• interactions: add AutomaticContinuation to Interactions.Create in the Go SDK (0a6da26)
• interactions: declare continuation_ids on Interaction (5b54979)
• support video understanding in Gemini Developer API (5407437)

Bug Fixes

• interactions: align SDK User-Agent and x-goog-api-client headers (58187ad)

Changelog

Sourced from google.golang.org/genai's changelog.

1.77.0 (2026-10-29)

Features

• Add support for continuation_token and requires_continuation status (51d761f)
• add video upscale task parameter (cab8bf7)
• interactions: add AutomaticContinuation to Interactions.Create in the Go SDK (0a6da26)
• interactions: declare continuation_ids on Interaction (5b54979)
• support video understanding in Gemini Developer API (5407437)

Bug Fixes

• interactions: align SDK User-Agent and x-goog-api-client headers (58187ad)

Commits

• 1a33369 chore(main): release 1.77.0 (#1027)
• cab8bf7 feat: add video upscale task parameter
• 0a6da26 feat(interactions): add AutomaticContinuation to Interactions.Create in the G...
• 58187ad fix(interactions): align SDK User-Agent and x-goog-api-client headers
• 5407437 feat: support video understanding in Gemini Developer API
• 5b54979 feat(interactions): declare continuation_ids on Interaction
• d386bce chore(cli): update Speakeasy OpenAPI generator to v2.952.4
• 51d761f feat: Add support for continuation_token and requires_continuation status
• 9ba857f chore: update Speakeasy OpenAPI generator to v2.950.11 and bump CLI to v0.4.4
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Copilot]

🟡 Changes recommended

Resuming a session drops ExcludedManagedSettings, restoring full enforcement and losing caller-configured exclusions; the resume configuration must forward the field and the regression test must cover it.

1 open issue

• Preserve excluded managed settings when resuming sessions · New

What changed in this PR

Updates three SDK dependencies used by the framework’s Copilot, OpenAI, and Gemini providers, with corresponding checksum updates.

Changes:

• Bumps Copilot SDK from 1.0.26 to 1.0.28.
• Bumps OpenAI SDK from 3.88.0 to 3.90.0 and Google GenAI from 1.76.0 to 1.77.0.
• Refreshes dependency checksums, including transitive AWS SDK updates.

File	Description
go.sum	Updates checksums for the upgraded SDKs and transitive dependencies.
go.mod	Raises the three direct SDK dependency versions.

_{Review effort: Balanced}