chore(deps): bump agent-governance-sdk to 5.0.0 in the three CLI packages, with audit

[Imran Siddique (imran-siddique)]

Consolidates #3686, #3683 and #3681, and adds the dependency audit that unblocks them.

Why they cannot land on their own

scripts/ci/vendored-patch-audit.sh exempts Dependabot only for non-major updates:

[ -n "$DEPENDABOT_UPDATE_TYPE" ] && \
[ "$DEPENDABOT_UPDATE_TYPE" != "version-update:semver-major" ]

These three run with DEPENDABOT_UPDATE_TYPE: version-update:semver-major, so the exemption does not apply and the gate requires an audit doc. It looks for that doc in the PR's own diff:

CHANGED_FILES=$(git diff --name-only "$BASE_REF"...HEAD)
AUDIT_DOC=$(grep -E '^docs/dependency-audits/[0-9]{4}-...' <<< "$CHANGED_FILES")

Dependabot does not write audit docs, so a semver-major Dependabot PR can never satisfy this gate on its own branch, and a separate doc PR would not satisfy it either. All three have been red on Dependency Audit Trail since 2026-08-11 for that reason, not because anything is wrong with them.

What this PR contains

The three Dependabot commits cherry-picked unchanged, plus one audit doc. Verified with git diff against each original head: package.json and package-lock.json in all three packages are byte-identical to what Dependabot produced. Their Signed-off-by: dependabot[bot] trailers are preserved, so authorship and DCO are intact.

bash scripts/ci/vendored-patch-audit.sh origin/main passes on this branch.

The finding worth reading

The audit is not a rubber stamp. This bump does not clear these packages of a js-yaml advisory.

• Outgoing js-yaml 4.1.1 is in range for two HIGH advisories: GHSA-5p4m-2wfm-xmqj (patched 4.3.1) and GHSA-52cp-r559-cp3m (patched 4.3.0).
• Incoming js-yaml 5.2.1, the SDK's own pin, is in range for GHSA-pm4m-ph32-ghv5, HIGH, >= 5.0.0, <= 5.2.1, first patched in 5.2.2. Current release is 5.2.3.

Two HIGH to one HIGH is the right direction and is not the same as clean. The durable fix is repinning js-yaml in the SDK rather than overriding it in three CLI lockfiles, so I have not attempted it here. Happy to open that separately if you want it.

Otherwise the risk is low. The SDK major is the monorepo-wide v5 version alignment from the [5.0.0] CHANGELOG entry, not an API break; the published 4.0.0 and 5.0.0 manifests agree on every @noble/* pin, on engines.node >=18.0.0 and on the license. Each of the three CLI packages already ships at 5.0.0 while pinning the 4.0.0 SDK, so this is the first time their published version and their SDK agree.

Suggested handling

Close #3686, #3683 and #3681 in favour of this, or tell me you would rather have three separate PRs each carrying its own copy of the doc and I will redo it that way.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@microsoft/agent-governance-sdk	5.0.0	🟢 7.9	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Dependency-Update-Tool 🟢 10 update tool detected Security-Policy 🟢 10 security policy file detected Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices 🟢 5 badge detected: Passing Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 License 🟢 10 license file detected SAST 🟢 10 SAST tool is run on all commits Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Fuzzing 🟢 10 project is fuzzed Packaging 🟢 10 packaging workflow detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 17 contributing companies or organizations Vulnerabilities ⚠️ 0 49 existing vulnerabilities detected
npm/@microsoft/agent-governance-sdk	5.0.0	🟢 7.9	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Dependency-Update-Tool 🟢 10 update tool detected Security-Policy 🟢 10 security policy file detected Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices 🟢 5 badge detected: Passing Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 License 🟢 10 license file detected SAST 🟢 10 SAST tool is run on all commits Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Fuzzing 🟢 10 project is fuzzed Packaging 🟢 10 packaging workflow detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 17 contributing companies or organizations Vulnerabilities ⚠️ 0 49 existing vulnerabilities detected
npm/@microsoft/agent-governance-sdk	5.0.0	🟢 7.9	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Dependency-Update-Tool 🟢 10 update tool detected Security-Policy 🟢 10 security policy file detected Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices 🟢 5 badge detected: Passing Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 License 🟢 10 license file detected SAST 🟢 10 SAST tool is run on all commits Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Fuzzing 🟢 10 project is fuzzed Packaging 🟢 10 packaging workflow detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 17 contributing companies or organizations Vulnerabilities ⚠️ 0 49 existing vulnerabilities detected
npm/@microsoft/agent-governance-sdk	5.0.0	🟢 7.9	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Dependency-Update-Tool 🟢 10 update tool detected Security-Policy 🟢 10 security policy file detected Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices 🟢 5 badge detected: Passing Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 License 🟢 10 license file detected SAST 🟢 10 SAST tool is run on all commits Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Fuzzing 🟢 10 project is fuzzed Packaging 🟢 10 packaging workflow detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 17 contributing companies or organizations Vulnerabilities ⚠️ 0 49 existing vulnerabilities detected

Scanned Files

• agent-governance-antigravity-cli/package-lock.json
• agent-governance-claude-code/package-lock.json
• agent-governance-copilot-cli/package-lock.json
• agent-governance-copilot-cli/package.json

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[github-actions]

📦 Dependency diff (SBOM)

Comparing main → chore/sdk-5-cli-packages.

Summary: ➕ 0 added · ➖ 0 removed · 🔄 3 bumped

🔄 Bumped

npm (3)

Package	From	To
%40microsoft/agent-governance-antigravity-cli	4.0.0	5.0.0
%40microsoft/agent-governance-claude-code	4.0.0	5.0.0
%40microsoft/agent-governance-copilot-cli	4.0.0	5.0.0

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	LOW
Overall	HIGH

Automated check by AGT Contributor Check.

[Prayag (prayagupa)]

Correctly consolidates the three semver-major SDK bumps (#3686/#3681/#3683) byte-identical plus the required audit doc; all checks green. Note the carried-forward js-yaml advisory (GHSA-pm4m-ph32-ghv5, patched in 5.2.2) — durable fix is repinning js-yaml in the SDK. LGTM.

[Imran Siddique (imran-siddique)]

MohammadHaroonAbuomar liamcrumm — gentle nudge when you have a moment. This is the SDK 5.0.0 dependency update across the CLI packages, including the audit notes.

[Imran Siddique (imran-siddique)]

Prayag (@prayagupa) your approval from 08-12 was dismissed automatically when I merged main in on 08-19 to clear the stale-branch block. The PR's own diff is unchanged: same 9 files, +139/-34, and the merge only picked up main's additions to .cspell.json and .cspell-repo-terms.txt. Sorry for the churn. Would you mind re-approving?

[Prayag (prayagupa)]

Thanks — the diagnosis of why #3686, #3683 and #3681 can't satisfy the audit gate on their own branches is correct and worth landing.

One blocker: the doc reads the SDK's declared js-yaml, but the resolved version is 4.2.0 at base and head — so both 4.x HIGH advisories remain and GHSA-pm4m-ph32-ghv5 doesn't apply.

Separately, build-npm for agent-governance-antigravity-cli skipped (no pkg-agent-governance-antigravity-cli paths-filter), so it got no build validation here.

[Prayag (prayagupa)]

blocker: Resolved js-yaml is 4.2.0 at base and head — the root overrides overrules the SDK's 5.2.1. So GHSA-pm4m-ph32-ghv5 doesn't apply, and both 4.x HIGH advisories still do. Could you re-derive this from the resolved tree? It's two HIGH to two, not two to one.

[Prayag (prayagupa)]

major: Base already resolved a single js-yaml (4.2.0), so nothing is de-duplicated. What the diff actually removes is the lockfile root overrides block. Could you reword this to match?

[Prayag (prayagupa)]

major: The lockfile root drops overrides while package.json keeps overrides: {"js-yaml": "4.2.0"}. I checked — this is Dependabot's own output, byte-identical to #3683, so please don't regenerate. The durable fix is dropping the override from the three package.json files, as your doc argues.

[Imran Siddique (imran-siddique)]

Prayag (@prayagupa) you are right, and I have pushed the correction rather than argued it. Thank you for not just re-approving when I asked you to.

Your blocker, verified

I reproduced it rather than reasoning about it. npm ci in agent-governance-antigravity-cli at this branch's head, then npm ls js-yaml:

@microsoft/agent-governance-antigravity-cli@5.0.0
`-- @microsoft/agent-governance-sdk@5.0.0
  `-- js-yaml@4.2.0 overridden

npm audit on that same tree:

high  GHSA-52cp-r559-cp3m   range=>=4.0.0 <4.3.0
high  GHSA-5p4m-2wfm-xmqj   range=>=4.0.0 <4.3.1

So the installed parser is 4.2.0 at base and at head, both 4.x HIGH advisories remain in range, and GHSA-pm4m-ph32-ghv5 cannot apply because 5.2.1 is never installed. The document's central claim, that the bump exchanges two HIGH advisories for one, was wrong in the direction that flatters the PR. I read the SDK's declared pin and never checked what actually resolves.

Worse, the same document argued that "overriding js-yaml in three CLI lockfiles would be the wrong fix", while all three package.json files have carried exactly that override the whole time. I was writing about a tree I had not installed.

A second defect, which I found looking for yours

The regenerated lockfiles here dropped the root overrides block while package.json kept declaring it. On main the two agree:

main:  package.json overrides={'js-yaml':'4.2.0'}   lock.root.overrides={'js-yaml':'4.2.0'}
head:  package.json overrides={'js-yaml':'4.2.0'}   lock.root.overrides=None

The node_modules/js-yaml entry still pinned 4.2.0, so the installed tree was right and npm ci passed either way, which is exactly why 110 green checks said nothing. But the lockfile had stopped recording the reason for its own pin, and the next regeneration would have moved it. Restored in all three.

The sequencing you should know about

Jeff Stock (@jstock03)'s #3843, #3844 and #3875 move the override 4.2.0 to 4.3.1 in the antigravity, Claude Code and Copilot CLI packages. That clears both advisories above, and it is the change that actually improves the security position here. They touch the same package.json and package-lock.json files this PR does, so we conflict. I would land theirs first and rebase this one on top, since the SDK bump is a version-line alignment with no urgency and theirs is the advisory fix. Happy to be told otherwise.

What changed in this push

• The audit document's dependency and advisory sections rewritten around the resolved version rather than the declared one, with the npm audit output and the conflict with fix: update Antigravity js-yaml override #3843/fix: update Claude Code js-yaml override #3844/fix: update Copilot CLI js-yaml override #3875 recorded.
• The Breaking Change section corrected: the js-yaml 4.x to 5.x major is not reached at all, so the risk paragraph built on it was wrong too.
• The root overrides block restored in the three lockfiles.
• No change to the SDK bump itself. Still the same nine files, and the lockfile diff is three lines per package.

On your second point

build-npm skipping agent-governance-antigravity-cli for want of a pkg-agent-governance-antigravity-cli paths-filter is a real gap and it is not this PR's to fix, since the filter has been missing for every PR that has touched that package. I would rather it went in on its own so it is visible as a CI change. Say the word if you would prefer it here instead.