Bumps [reproducible-containers/buildkit-cache-dance](https://github.com/reproducible-containers/buildkit-cache-dance) from 3.3.1 to 3.3.2.
- [Release notes](https://github.com/reproducible-containers/buildkit-cache-dance/releases)
- [Commits](reproducible-containers/buildkit-cache-dance@6f699a7...1b8ab18)

---
updated-dependencies:
- dependency-name: reproducible-containers/buildkit-cache-dance
  dependency-version: 3.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@2634353...10e90e3)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 6.19.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

Bumps golang from 1.25.7-alpine to 1.25.8-alpine.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.25.8-alpine
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 4.0.0 to 4.1.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@faadad0...ba7bc0a)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

Adds `resolve_thread` and `unresolve_thread` methods to the
`pull_request_review_write` tool, enabling users to resolve and
unresolve PR review threads via GraphQL mutations.

- Add ThreadID field to PullRequestReviewWriteParams struct
- Add threadId parameter and new methods to tool schema
- Implement ResolveReviewThread function using GraphQL mutations
- Add switch cases for resolve_thread and unresolve_thread methods
- Add unit tests covering success, error, empty and omitted threadId
- Document that owner/repo/pullNumber are unused for these methods
- Document idempotency (resolving already-resolved is a no-op)
- Update toolsnaps and generated docs

Fixes #1768

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Allows users running multiple GitHub MCP Server instances (e.g., for
github.com and GitHub Enterprise Server) to override the server name and
title in the MCP initialization response.

- Add --server-name / GITHUB_SERVER_NAME flag+env to override name
- Add --server-title / GITHUB_SERVER_TITLE flag+env to override title
- Defaults remain "github-mcp-server" and "GitHub MCP Server"
- Applies to both stdio and HTTP server modes
- Add tests for default and custom name/title

Co-authored-by: SamMorrowDrums <[email protected]>

Instead of new CLI flags (--server-name, --server-title), reuse the
existing string override mechanism that already supports tool title/
description overrides throughout the codebase.

Users can now configure the server name and title via:
  - GITHUB_MCP_SERVER_NAME / GITHUB_MCP_SERVER_TITLE env vars
  - "SERVER_NAME" / "SERVER_TITLE" keys in github-mcp-server-config.json

This is consistent with how all other user-visible strings are
overridden (e.g. GITHUB_MCP_TOOL_GET_ME_USER_TITLE). No new struct
fields or CLI flags are needed.

Co-authored-by: SamMorrowDrums <[email protected]>

Add documentation for the server name and title customization feature
to the README i18n section and server-configuration.md quick reference.
This helps users running multiple GitHub MCP Server instances discover
how to configure unique identities via environment variables or the
config JSON file.

Co-authored-by: Anika Reiter <[email protected]>
Co-authored-by: Copilot <[email protected]>

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.19.2 to 7.0.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@10e90e3...d08e5c3)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.10.0 to 6.0.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c299e40...030e881)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

Add three optional parameters to the list_commits tool that map to
existing GitHub API query parameters:

- path: filter commits to those touching a specific file or directory
- since: only commits after this date (ISO 8601)
- until: only commits before this date (ISO 8601)

These parameters are already supported by the go-github library's
CommitsListOptions struct but were not exposed by the MCP tool.

The path filter is particularly useful for monorepo workflows where
commit history needs to be scoped to a specific project subdirectory.

Time parsing uses the existing parseISOTimestamp helper (shared with
list_issues and list_gists) which accepts both YYYY-MM-DDTHH:MM:SSZ
and YYYY-MM-DD formats.

Closes #197

Some MCP clients require array item schemas to explicitly set
`additionalProperties: false`. Without this, `push_files` calls will fail.

Fixes #2011
Research and fix was initially done by @04cb

* initial logging stack for http

* add metrics adapter

* fix linter issues

* make log fields generic

* Update pkg/github/server_test.go

Co-authored-by: Copilot <[email protected]>

* Remove unused SlogMetrics adapter

The slog-based metrics adapter was never used — OSS always uses
NoopMetrics and the remote server has its own DataDog-backed adapter.

Co-authored-by: Copilot <[email protected]>

* Update pkg/github/dependencies.go

Co-authored-by: Copilot <[email protected]>

* fmt

* change to use slog

* address feedback

* rename noop adapter to noop sink

* Update pkg/http/server.go

Co-authored-by: Copilot <[email protected]>

* [WIP] [WIP] Address feedback on OSS logging adapter for http implementation (#2264)

* Initial plan

* Fix BaseDeps.Logger and BaseDeps.Metrics to return safe defaults when Obsv is nil

Agent-Logs-Url: https://github.com/github/github-mcp-server/sessions/53221b0b-abb4-4138-a147-3ce9e13b379a

Co-authored-by: mattdholloway <[email protected]>

* Fix nil metrics in server.go by passing metrics.NewNoopMetrics() to NewExporters

Agent-Logs-Url: https://github.com/github/github-mcp-server/sessions/53221b0b-abb4-4138-a147-3ce9e13b379a

Co-authored-by: mattdholloway <[email protected]>

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: mattdholloway <[email protected]>
Co-authored-by: Matt Holloway <[email protected]>

* replace nil with stubs

---------

Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>

* Update issue templates

* Update insiders-feedback.md

…iltering

The HTTP server now respects the same static CLI flags as the stdio
server: --toolsets, --tools, --exclude-tools, --read-only,
--dynamic-toolsets, and --insiders.

A static inventory is built once at startup from these flags, producing
a pre-filtered tool/resource/prompt universe. Per-request headers
(X-MCP-Toolsets, X-MCP-Tools, etc.) can only narrow within these
bounds, never expand beyond them. When no static flags are set, the
existing behavior is preserved — headers have full access to all
toolsets.

Fixes #2156

Co-authored-by: Copilot <[email protected]>

* initial OSS granular PRs and issues toolsets

* update docs

* refactor: reuse existing helpers in granular toolsets

Refactor granular issue and PR tools to delegate to existing tested
helper functions instead of reimplementing logic from scratch:

- Sub-issue tools (add/remove/reprioritize) now delegate to existing
  REST-based AddSubIssue, RemoveSubIssue, ReprioritizeSubIssue helpers
- PR review tools (create/submit/delete) now delegate to existing
  CreatePullRequestReview, SubmitPendingPullRequestReview,
  DeletePendingPullRequestReview helpers (fixes viewer filtering bug)
- Review comment tool now uses viewer-safe pattern from
  AddCommentToPendingReview (query viewer, filter by author, validate
  PENDING state, pass PullRequestReviewID)
- Fix milestone param to use RequiredInt instead of float64 cast
- Fix line/startLine params to use OptionalIntParam
- Draft state tool uses typed GraphQL inputs matching existing patterns
- Remove duplicate GraphQL types and helper functions
- Add toolsnap tests for all 20 granular tools
- Update generated docs

Co-authored-by: Copilot <[email protected]>

* refactor: use feature flags instead of separate granular toolsets

Place granular tools in existing issues/pull_requests toolsets with
FeatureFlagEnable, instead of creating separate issues_granular and
pull_requests_granular toolsets. This is simpler and uses the existing
feature flag infrastructure to switch between consolidated and
granular tool variants at runtime.

Co-authored-by: Copilot <[email protected]>

* fix: address review feedback on granular toolsets

- Fix REST response handling: capture resp, close body, use ghErrors
  helpers in issueUpdateTool, prUpdateTool, GranularCreateIssue, and
  GranularRequestPullRequestReviewers
- Add FeatureFlagDisable on consolidated tools (IssueWrite, SubIssueWrite,
  UpdatePullRequest, PullRequestReviewWrite, AddCommentToPendingReview)
  so they are hidden when granular variants are active
- Use OptionalStringArrayParam for assignees, labels, reviewers instead
  of manual loop that silently dropped non-string elements
- Fix side/startSide empty string leak: pass nil pointer when absent
  instead of pointer to empty string in GraphQL mutations
- Fix milestone minimum from 0 to 1 to match RequiredInt rejection of 0
- Return MinimalResponse {id, url} instead of full JSON objects
- Fix RequiredParam[bool] rejecting draft=false by using presence check
- Add handler tests for update_pull_request_draft_state (draft + ready)
  and add_pull_request_review_comment with full GraphQL mocking

Co-authored-by: Copilot <[email protected]>

* fix: address review feedback on granular toolsets

- Fix translation keys to use ALL_CAPS convention (strings.ToUpper)
- Fix assignees/labels clearing: check key presence instead of len==0
- Extract AddCommentToPendingReviewCall helper to deduplicate GraphQL
  logic between consolidated and granular tools
- Add missing granular tools: resolve_review_thread, unresolve_review_thread
  (were in pull_request_review_write but had no granular replacements)
- Add handler tests for new resolve/unresolve tools

Co-authored-by: Copilot <[email protected]>

---------

Co-authored-by: Sam Morrow <[email protected]>
Co-authored-by: Copilot <[email protected]>