Repository navigation
Merge upstream main to resolve conflicts in dependency-update PR #3400 - #19
Merged
Merged
Conversation
…#3323) * Identify STDIO API clients across MCP protocols Preserve release identities, resolve actual source revisions, and attach upstream client metadata per request without mutating shared transports. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6dde41da-ec25-4370-b26c-b036d0a53b3c * Escape MCP client metadata and preserve revision provenance Encode upstream client comments as valid HTTP header data, keep explicit build revisions independent of embedded dirty state, and reject null source hashes. Cover protocol wire behaviour and document the version-source contract. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6dde41da-ec25-4370-b26c-b036d0a53b3c * Preserve STDIO startup without usable version metadata Skip invalid build metadata while retaining release and revision precedence. Fall back to dev with a stderr warning rather than preventing startup, and cover the compatibility contract in tests and documentation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6dde41da-ec25-4370-b26c-b036d0a53b3c --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6dde41da-ec25-4370-b26c-b036d0a53b3c
…b#3348) * Always enable MCP Apps UI; remove remote_mcp_ui_apps flag gate The remote_mcp_ui_apps flag is fully rolled out on the hosted server, but the OSS server still defaulted it off. Make MCP Apps unconditional: - _meta.ui is always emitted, stripped only when the client explicitly does not advertise the io.modelcontextprotocol/ui capability - ui_get is always registered - write tools defer to MCP App forms by default (still opt-out via mcp_apps_disable_form_deferral) - remove MCPAppsFeatureFlag and its AllowedFeatureFlags/InsidersFeatureFlags entries - update tests and regenerate docs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Remove unused Inventory.checkFeatureFlag Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Omit app-only tools for clients without MCP Apps support When a client does not advertise io.modelcontextprotocol/ui, stripping _meta.ui from ui_get turned it into an ordinary model-visible tool, violating its app-only contract. Now that ui_get is no longer feature gated, omit tools whose ui.visibility excludes "model" instead. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Only tag builds should supply a release version. Other Docker builds use the existing linked-commit fallback instead of treating a branch or pull-request ref name as a release. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6dde41da-ec25-4370-b26c-b036d0a53b3c
…nts and PR reviews (github#3350) * Add hide_comment and unhide_comment granular issue tools Add two tools behind the issues_granular feature flag that hide (minimize) and unhide (unminimize) comments via the GraphQL minimizeComment/unminimizeComment mutations. They support issue and pull request conversation comments, pull request review comments, and pull request review bodies. Callers pass the numeric REST ID plus a comment_type; the tool resolves the GraphQL node ID via the matching REST endpoint before mutating. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Rename comment_type enum values to pull_request_review(_comment) Use `pull_request_review` and `pull_request_review_comment` instead of `review` and `review_comment` so the comment_type values are explicit about which object they refer to. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Use realistic minimizedReason values in hide_comment test mocks GitHub returns minimizedReason in lowercase, hyphenated form (e.g. "off-topic") rather than echoing the classifier enum, as confirmed by an end-to-end run against the live API. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Split hide/unhide comment tools per object type Replace hide_comment/unhide_comment, which took a comment_type argument, with a granular pair per object type: - hide_issue_comment / unhide_issue_comment (issues_granular): issue comments and pull request conversation comments - hide_pull_request_review_comment / unhide_pull_request_review_comment (pull_requests_granular): inline pull request review comments - hide_pull_request_review / unhide_pull_request_review (pull_requests_granular): pull request review bodies Every argument is now unconditionally required, so the schemas no longer need prose explaining which arguments apply to which type. The six tools are built from one shared helper, parameterised by a commentVisibilityTarget that describes each object type and how to resolve its GraphQL node ID. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Validate classifier and IDs before calling the GitHub API JSON schema constraints (enum, minimum) aren't enforced when tool arguments are unmarshalled, so an invalid classifier or a negative ID previously reached GitHub and surfaced as a confusing 404 or GraphQL error. Reject them up front with a clear argument error instead. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…to work when the authenticated actor is a Copilot bot (github#3355)
…ub#3370) * ci(deps): refresh workflow dependencies and align lint Go version Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * build(deps): refresh safe dependencies and Dependabot coverage Remediate all nine open npm alerts, update compatible Go and UI dependencies, refresh pinned Actions and the Go image, and backport the Cosign verification fix. Add weekly npm updates and regenerate third-party notices. Raise the minimum supported Go version to 1.26.8 for the latest x/net dependency and align CI linting with that toolchain. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * ci: preserve Docker tag ordering and remove trailing whitespace Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore: regenerate license files Auto-generated by license-check workflow * chore: regenerate license files Auto-generated by license-check workflow --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Resolve new modernization findings and document narrow false-positive suppressions. Verify Go 1.26.8 and 1.27.1 support and remove obsolete export-data compatibility guidance. Refresh cached linter binaries when the repository pin changes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Migrate all go-github imports and issue comment requests while preserving MCP schemas and payloads. Let v92 escape ruleset branch names exactly once. Refresh dependency license reports and narrowly retain the supported Ptr helper for compatibility with the pinned linter. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* feat(ui): migrate MCP Apps SDK to v2 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix: migrate go-github Ptr calls for Go 1.26 lint Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* ci: migrate cosign to v3 with legacy signature compatibility Keep legacy image payloads, .sig tags, and Rekor v1 service defaults. Document exact cosign v2/v3 image verification and unchanged release archive attestations. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * ci: dual-publish legacy and native cosign image signatures Sign the same immutable digest in separate fail-fast steps. Retain legacy signatures and publish native bundles with v3 service defaults. Remove the verification documentation introduced by this PR as requested; keep compatibility evidence and rollout plans in the PR description. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* build(ui): migrate to React 19 and Primer React 38 Replace removed Box and sx APIs with native styles and CSS Modules, load Primer CSS tokens, use the CSS-based theme provider and Banner, and scope custom-element JSX types to the React runtime. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * fix(ui): use CSS token for reviewer label backgrounds Replace leftover canvas.inset theme paths with the CSS custom property in PR creation and editing. Keep the reviewed native gaps unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: parvezmosharafvu <308653838+parvezmosharafvu@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Merge upstream main and resolve conflicts in dependency files
Merge upstream main to resolve conflicts in dependency-update PR #3400
Oct 3, 2026
parvezmosharafvu
approved these changes
Oct 3, 2026
parvezmosharafvu
marked this pull request as ready for review
October 3, 2026 06:01
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @parvezmosharafvu, your pull request is larger than the review limit of 150,000 diff characters
parvezmosharafvu
approved these changes
Oct 3, 2026
parvezmosharafvu
self-requested a review
October 3, 2026 06:25
parvezmosharafvu
approved these changes
Oct 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Merges
github/github-mcp-servermaininto this fork'smainso upstream PR github#3400 ("Update dependencies including fast-uri, browserslist, and golang") no longer conflicts.Why
The fork and upstream have unrelated histories, so the merge needs
--allow-unrelated-historiesand produced add/add conflicts in about 128 files. Upstream is already newer than the fork's tree for Go dependencies andui/package.json.What changed
main(upstream/main). All conflicts are resolved by taking upstream's version, so unrelated code matches upstream.Dockerfile: keeps the fork's newergolangandnodebase-image digests, which is the PR's intent.go.mod:go 1.26.8, which upstream already has.go mod tidymade no changes.ui/package-lock.json:fast-uriandbrowserslistare not in upstream's lockfile, sonpm updatechanged nothing..github/workflows/codeql.ymland a vendoredgo-github/v89LICENSE. Reviewers may want to drop them.MCP impact
No tools changed, so there is nothing to regenerate with
script/generate-docs.Prompts tested (tool changes only)
Security / limits
Tool renaming
deprecated_tool_aliases.goNote: if you're renaming tools, you must add the tool aliases. For more information on how to do so, please refer to the official docs.
Lint & tests
./script/lint(not run)./script/testgo build ./...also passes.Docs