chore(deps): bump @github/copilot from 1.0.4 to 1.0.43 in /nodejs

[dependabot]

Bumps @github/copilot from 1.0.4 to 1.0.43.

Release notes

Sourced from @​github/copilot's releases.

1.0.43

2026-05-06

• Add username toggle to /statusline picker to display the active account in the footer
• Auto mode uses server-side model routing for improved real-time model selection
• Resume prompt shows correct session name when multiple sessions are active
• Protect against RCE from malicious bare repositories nested inside a project (for more information, GHSA-9ccr-r5hg-74gf)
• MCP server child processes (e.g. started via npx or uvx) are now fully terminated when a session ends
• Show download progress when running the update command

1.0.43-0

Improved

• Show download progress when running the update command

Fixed

• MCP server child processes (e.g. started via npx or uvx) are now fully terminated when a session ends

1.0.42

2026-05-06

• MCP server failure warning now suggests a directly runnable /mcp show command when the server name contains whitespace
• MCP server failure warnings include stderr output to help diagnose connection errors
• Add -C flag to change working directory before starting, similar to git -C
• Exit message resume command shows session ID instead of auto-generated name when session has not been renamed
• Remote session export now supports non-GitHub repositories and repo-less directories
• Resuming a session no longer shows a false "session in use" warning after choosing "Go back"
• Enter key no longer gets permanently stuck after cancelling a request
• Suppress the exit summary when the session has no user messages and no saved session to resume
• CLI updates on Windows no longer fail with ENOENT when a transient EPERM occurs during package extraction
• Add rubber-duck agent for GPT sessions, powered by Claude (available in /experimental)

1.0.42-0

Added

• Add rubber-duck agent for GPT sessions, powered by Claude (available in /experimental)

1.0.41

2026-05-05

• CLI starts faster by rendering the UI immediately while authentication resolves in the background
• Shell completions (bash, zsh, fish) are automatically installed on first run and updated after copilot update
• Tab-completing slash commands that accept arguments now adds a trailing space automatically
• Package extraction no longer crashes on Windows when antivirus or filesystem locks cause transient EPERM errors
• Remote session connection errors show your logged-in account and tailored remediation steps
• Markdown formatting renders in ask user prompt questions
• Add experimental MCP Tasks support: MCP tools with taskSupport: "required" run as non-blocking background agents trackable via list_agents and read_agent (available when experimental mode is enabled, e.g. via /experimental on or the --experimental flag)
• Extensions now load in prompt mode (-p). User extensions load by default; project extensions alnd management tools require GITHUB_COPILOT_PROMPT_MODE_EXTENSIONS=true.
• Assistant responses no longer contain spurious system notification XML tags
• Large output guidance correctly references the configured grep tool name
• Adding a plugin marketplace using a git SSH URL (e.g. git@github.com:owner/repo) now works correctly
• Slash command picker searches command descriptions and underlines matched characters

... (truncated)

Changelog

Sourced from @​github/copilot's changelog.

1.0.49 - 2026-05-18

• postToolUse hook additionalContext is now injected as a system message for the model instead of being silently discarded
• Mouse clicks in the prompt correctly position cursor when input contains wide characters (CJK, emoji)
• Add /chronicle search subcommand to search all session content by keyword or topic
• /user switch reuses the fetched user list and shows a loading spinner on first open
• MCP servers using static OAuth clients correctly persist registration for token refreshes
• Add support for running the CLI on Alpine Linux (musl libc)
• Add /exit print option to print the session to the terminal before exiting
• Add /rubber-duck command to get an independent critique of the agent's current work
• Add /session id subcommand to display the current session ID and copy it to the clipboard
• Add auth.redirectPort config option for MCP servers to pin the OAuth callback to a fixed port
• Add /memory on|off|show slash command to enable, disable, or view memory status (persistent)
• Add copilot plugin update --all to update all installed plugins at once
• Add /rubber-duck command to invoke the rubber duck agent for an independent critique (experimental)
• Input prompt collapses to a single line when empty and grows naturally as you type
• File diffs are correctly reported to ACP clients for all edit tool types
• Repo hooks in .github/hooks/ now load in prompt mode (-p) when the folder is already trusted
• Fix extra line in timeline entries
• Box drawing and block characters render correctly on Windows terminals not using UTF-8 code page
• MCP server configurations with no args field are now accepted and treated as an empty args list
• Document attachment paths are included in context so the agent can reference pasted file paths, including Windows Copy as path inputs
• MCP stdio servers now display type as 'stdio' instead of 'local' for consistency
• Progress bar indicator now displays correctly in tmux sessions
• Experimental slash commands are now annotated with "(experimental)" in the help dialog and command picker
• Auto-update downloads the smaller platform-specific package instead of the universal one when available
• Auto-link GitHub issue and PR references (owner/repo#number) in assistant responses
• Prompt mode (-p) automatically loads workspace MCP sources when the current folder is already trusted
• Experimental: /mcp search command to search and install MCP servers from registry
• Experimental: Tool search with deferred loading for MCP and external tools
• Add "None" reasoning effort option to disable model reasoning in the reasoning effort picker
• Add COPILOT_PLUGIN_DIR_ONLY environment variable to disable automatic plugin discovery, enabling deterministic plugin sets when using --plugin-dir
• Copying text from the scroll view joins soft-wrapped lines without extra newlines or indentation
• Cursor positioning in input fields works correctly with wide characters (CJK, emoji)
• Hooks (preToolUse, postToolUse, subagentStart, subagentStop) now fire correctly for sub-agent tool calls
• Plugins loaded via --plugin-dir now correctly register their agents as available task(agent_type=...) subagents in prompt mode
• Memory storage correctly limits available scopes when no repository context is present
• --plugin-dir and --additional-mcp-config now work in --server / --headless mode
• Content-filtered model responses now display an explanation instead of a blank assistant turn
• PromptFrame UI now renders inside tmux when the outer terminal is ghostty, WezTerm, or kitty (detected via tmux list-clients).
• MCP OAuth token lookups are correctly scoped to the active session
• Memory permission prompts now name who can see a stored memory: user scope or the specific owner/repo for repository scope. Timeline entries also show the scope ((for user) / (shared with repository collaborators)).
• Reduce PowerShell syntax errors on Windows by avoiding && chaining instructions when using legacy PowerShell 5.x

1.0.48 - 2026-05-14

• Model picker displays actual token prices instead of dot indicators for token-based billing users
• Instruction files with unquoted glob patterns in applyTo frontmatter (e.g. applyTo: */.ts) are now applied correctly
• Input text with CJK characters or emoji renders without blank gaps between lines
• /context shows correct token limits for all models instead of always showing 128k

... (truncated)

Commits

• 5ab6de6 Update changelog.md for version 1.0.42
• ac346d1 Update changelog.md for version 1.0.41
• cc85e32 Update changelog.md for version 1.0.40
• cb0ddf8 Update changelog.md for version 1.0.39
• 4e5cb95 Update changelog.md for version 1.0.37
• 6d1c577 Update changelog.md for version 1.0.36
• d7a0581 Update changelog.md for version 1.0.35
• 6594437 Update changelog.md for version 1.0.34
• 75fbe0c Update changelog.md for version 1.0.33
• 4e51f5a Update changelog.md for version 1.0.32
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud