diff --git a/Directory.Packages.props b/Directory.Packages.props
index bf6de3940..52c612a08 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -47,7 +47,7 @@
YamlStaticContext for the doc pipeline's YAML DTOs (tools/Reactor.DocPipeline).
Analyzer-only (PrivateAssets=all). Version tracks YamlDotNet's major (18.x). -->
-
+
@@ -56,7 +56,7 @@
`winapp ui`, used in-process. Its Windows Graphics Capture build needs a Windows 10
19041+ TFM. The DI container is how the library hands out IWindowCapture. -->
-
+
@@ -71,19 +71,19 @@
-
-
-
-
+
+
+
+
-
-
+
+
-
+
diff --git a/docs/security/threat-model.md b/docs/security/threat-model.md
index 214592e10..4a3e958bb 100644
--- a/docs/security/threat-model.md
+++ b/docs/security/threat-model.md
@@ -284,7 +284,7 @@ Microsoft's internal Security Assessment policy lists six trust-boundary trigger
| `nuget.org` for direct & transitive deps | Compromise of upstream feed → poisoned dep gets pulled at restore | `nuget.config` clears inherited feeds and pins to `nuget.org` + `local-nupkgs/`. Dependabot enabled (`.github/dependabot.yml`). CI `vulnerable-packages` job runs [`dotnet list package --vulnerable`](https://learn.microsoft.com/dotnet/core/tools/dotnet-list-package) on every PR and fails on High/Critical findings. |
| Source-ported OSS (Yoga / md4c / D3) | Upstream defect ported in by hand without notice | `ThirdPartyNoticeText.txt` lists each; `cgmanifest.json` registers them with Component Governance so upstream advisories surface internally. |
| GitHub repo → NuGet publish | Compromised CI builds malicious package | `.github/workflows/release.yml` builds in `windows-latest` runner; BinSkim (PR #365) and CodeQL provide additional verification before publish. |
-| `GitHub.Copilot.SDK 1.0.14` transitive | Ships a third-party native `copilot.exe` runtime bundle (`runtimes//native/`), downloaded at build time from the github/copilot-cli GitHub releases and SHA-256-verified against the release's `SHA256SUMS.txt`, without Control Flow Guard | Known; tracked under the BinSkim follow-up. Not Reactor-authored. The binary is only present in the `mur` CLI publish artifact, not in the framework NuGet. |
+| `GitHub.Copilot.SDK 1.0.19` transitive | Ships a third-party native `copilot.exe` runtime bundle (`runtimes//native/`), downloaded at build time from the github/copilot-cli GitHub releases and SHA-256-verified against the release's `SHA256SUMS.txt`, without Control Flow Guard | Known; tracked under the BinSkim follow-up. Not Reactor-authored. The binary is only present in the `mur` CLI publish artifact, not in the framework NuGet. |
| Developer-downloaded skill-kit zip | Tampering between Microsoft and developer | Authenticode signing of the zip is a known compliance gap; tracked under the SDL signing workstream. |
## 11. Known open items / questions for internal security review
diff --git a/tests/build_props/ci/CopilotSdkContract.Tests.ps1 b/tests/build_props/ci/CopilotSdkContract.Tests.ps1
index cdfaebb93..41d4bf878 100644
--- a/tests/build_props/ci/CopilotSdkContract.Tests.ps1
+++ b/tests/build_props/ci/CopilotSdkContract.Tests.ps1
@@ -43,7 +43,7 @@ $packagesProps = Join-Path $repoRoot 'Directory.Packages.props'
# CopilotSkipCliDownload still gates the native CLI download, and that
# CopilotCliReleaseBaseUrl / COPILOT_CLI_DOWNLOAD_BASE_URL / CopilotCliBinaryPath
# still behave as Directory.Build.props and README.md describe. Then bump this.
-$reviewedSdkVersion = '1.0.14'
+$reviewedSdkVersion = '1.0.19'
$sdkPinned = [regex]::Match(
[IO.File]::ReadAllText($packagesProps),
'[^"]+)"').Groups['v'].Value