chore(deps): bump @github/copilot-sdk from 1.0.6 to 1.0.7

[dependabot]

Bumps @github/copilot-sdk from 1.0.6 to 1.0.7.

Release notes

Sourced from @​github/copilot-sdk's releases.

GitHub Copilot SDK for Java 1.0.7

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central](https://github.com/github/copilot-sdk/blob/HEAD/(central.sonatype.com/redacted)

📖 [Documentation](https://github.com/github/copilot-sdk/blob/HEAD/(github.github.io/redacted) · [Javadoc](https://github.com/github/copilot-sdk/blob/HEAD/(github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.7</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.7")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.7'

Feature: opaque metadata passthrough for tool definitions

Hosts can now attach namespaced, opaque metadata to tool definitions and have it forwarded verbatim over the session.create/resumeSession wire call. Use ToolDefinition.createWithMetadata(...) or the fluent .metadata(Map) builder, or express shallow flag maps via @CopilotTool.MetadataEntry annotations. (#1864)

ToolDefinition tool = ToolDefinition.create("search", "Search files", schema, handler)
    .metadata(Map.of("com.example:featureFlags", Map.of("streamResults", true)));

Feature: tool search configuration support

SessionConfig and ResumeSessionConfig now accept a ToolSearchConfig that enables server-side tool search and controls the deferral threshold. Tool results can also carry back toolReferences indicating which tools were consulted during search. (#1933)

SessionConfig config = new SessionConfig()
    .setToolSearch(new ToolSearchConfig().setEnabled(true).setDeferThreshold(5));

Other changes

• feature: [Java] forward enableManagedSettings on SessionConfig/ResumeSessionConfig to opt into enterprise managed-settings enforcement at session bootstrap (#1925)

... (truncated)

Changelog

Sourced from @​github/copilot-sdk's changelog.

v1.0.7 (2026-07-16)

Feature: in-process (FFI) transport

The SDK can now host the Copilot runtime in-process by loading the native runtime library via its C ABI (FFI), eliminating the overhead of spawning a child process. This experimental transport is available for Node.js, Rust, Python, and Go. (#1953, #1915, #1975, #1976)

const client = new CopilotClient({ connection: RuntimeConnection.forInProcess() });

var client = new CopilotClient(new CopilotClientOptions { Connection = RuntimeConnection.ForInProcess() });

Feature: tool search configuration

A new toolSearch session option controls how the SDK defers tools when the total tool count exceeds a threshold. When enabled (the default), excess MCP and external tools are surfaced on demand through the built-in tool_search_tool rather than pre-loaded into every prompt. Tool results can also include toolReferences to link cited sources back to the tool that produced them. (#1933)

const session = await client.createSession({
    toolSearch: { defer: "auto" },
});

var session = await client.CreateSessionAsync(new SessionConfig
{
    ToolSearch = new ToolSearchConfig { Defer = "auto" },
});

Feature: opaque metadata passthrough on tool definitions

Tool definitions now accept an optional metadata bag that is forwarded verbatim in session.create and session.resume RPC calls. This lets hosts attach namespaced, implementation-specific metadata to tools without expanding the typed public contract; unknown keys are preserved and round-tripped untouched. (#1864)

session.defineTool("my-tool", { metadata: { "myapp:priority": 1 } }, handler);

session.DefineTool("my-tool", new ToolOptions { Metadata = new() { ["myapp:priority"] = 1 } }, handler);

Other changes

• feature: [All SDKs] add canvasProvider field to session create/resume config so hosts can supply a stable canvas-provider identity that survives cold resume (#1847)
• feature: [All SDKs] forward enableManagedSettings flag in session create/resume for enterprise managed-settings enforcement (#1925)
• feature: [All SDKs] propagate agentId, parentAgentId, and interactionType from LLM inference start frames into request-handler contexts (#1949)
• improvement: [Rust] make tool schema and MCP server serialization deterministic by replacing HashMap with IndexMap (#1931)
• improvement: [Rust] use native-tls for the build-time CLI download (#1964)

... (truncated)

Commits

• d95cfac Update @​github/copilot to 1.0.71 (#1998)
• a023934 Avoid Windows in-process test teardown deadlock (#1997)
• 82b96a1 Add opaque metadata passthrough to SDK tool definitions (#1864)
• ffb4d98 Remove HMAC key authentication method from public SDK auth docs (#1994)
• 6e3893c [maven-release-plugin] prepare for next development iteration
• a4b7285 [maven-release-plugin] prepare release java/v1.0.7-preview.3
• caba3e5 docs: update version references to 1.0.7-preview.3
• 9744fd5 Update @​github/copilot to 1.0.71-2 (#1990)
• 584a239 docs: apply style guide conventions and fix trailing whitespace (#1979)
• 746fdd2 docs: update outdated gpt-4.1 model references in SDK docstrings (#1978)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)