From c5935f0c888badb9b2956e1484f868a8238c967b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 11 Aug 2026 09:09:06 +0000 Subject: [PATCH 1/7] chore(deps): Bump @microsoft/agent-governance-sdk Bumps [@microsoft/agent-governance-sdk](https://github.com/microsoft/agent-governance-toolkit/tree/HEAD/agent-governance-typescript) from 4.0.0 to 5.0.0. - [Release notes](https://github.com/microsoft/agent-governance-toolkit/releases) - [Changelog](https://github.com/microsoft/agent-governance-toolkit/blob/main/CHANGELOG.md) - [Commits](https://github.com/microsoft/agent-governance-toolkit/commits/v5.0.0/agent-governance-typescript) --- updated-dependencies: - dependency-name: "@microsoft/agent-governance-sdk" dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- agent-governance-claude-code/package-lock.json | 17 +++++++---------- agent-governance-claude-code/package.json | 2 +- 2 files changed, 8 insertions(+), 11 deletions(-) diff --git a/agent-governance-claude-code/package-lock.json b/agent-governance-claude-code/package-lock.json index afc454c84..fbba77134 100644 --- a/agent-governance-claude-code/package-lock.json +++ b/agent-governance-claude-code/package-lock.json @@ -1,34 +1,31 @@ { "name": "@microsoft/agent-governance-claude-code", - "version": "4.0.0", + "version": "5.0.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@microsoft/agent-governance-claude-code", - "version": "4.0.0", + "version": "5.0.0", "license": "MIT", "dependencies": { - "@microsoft/agent-governance-sdk": "4.0.0" + "@microsoft/agent-governance-sdk": "5.0.0" }, "engines": { "node": ">=22.0.0" - }, - "overrides": { - "js-yaml": "4.2.0" } }, "node_modules/@microsoft/agent-governance-sdk": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/@microsoft/agent-governance-sdk/-/agent-governance-sdk-4.0.0.tgz", - "integrity": "sha512-d6d2MIz3YbNI/7zrfCP9Kwzs1TFtqLka1eIb+n171+7crA/+KC0a2mbJnC5RmJPUKJ2RR+8ts+41/IGDvUFhMg==", + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/@microsoft/agent-governance-sdk/-/agent-governance-sdk-5.0.0.tgz", + "integrity": "sha512-6wh1g1GzEBy5Gq2dUEx5lampUoZaKRtqarQUt7skU63e4/uHi17RpmMm7brLd61iFWXf3N20hE0yZrRNjC439w==", "license": "MIT", "dependencies": { "@noble/ciphers": "2.2.0", "@noble/curves": "2.2.0", "@noble/ed25519": "3.1.0", "@noble/hashes": "2.2.0", - "js-yaml": "4.1.1" + "js-yaml": "5.2.1" }, "engines": { "node": ">=18.0.0" diff --git a/agent-governance-claude-code/package.json b/agent-governance-claude-code/package.json index 2a422c7db..d1d6d1a9a 100644 --- a/agent-governance-claude-code/package.json +++ b/agent-governance-claude-code/package.json @@ -39,7 +39,7 @@ }, "homepage": "https://github.com/microsoft/agent-governance-toolkit/tree/main/agent-governance-claude-code", "dependencies": { - "@microsoft/agent-governance-sdk": "4.0.0" + "@microsoft/agent-governance-sdk": "5.0.0" }, "overrides": { "js-yaml": "4.2.0" From 365dfc3f78af1ee32942988ca2d7d46ec2b4f1e8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 11 Aug 2026 09:09:02 +0000 Subject: [PATCH 2/7] chore(deps): Bump @microsoft/agent-governance-sdk Bumps [@microsoft/agent-governance-sdk](https://github.com/microsoft/agent-governance-toolkit/tree/HEAD/agent-governance-typescript) from 4.0.0 to 5.0.0. - [Release notes](https://github.com/microsoft/agent-governance-toolkit/releases) - [Changelog](https://github.com/microsoft/agent-governance-toolkit/blob/main/CHANGELOG.md) - [Commits](https://github.com/microsoft/agent-governance-toolkit/commits/v5.0.0/agent-governance-typescript) --- updated-dependencies: - dependency-name: "@microsoft/agent-governance-sdk" dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .../package-lock.json | 17 +++++++---------- agent-governance-antigravity-cli/package.json | 2 +- 2 files changed, 8 insertions(+), 11 deletions(-) diff --git a/agent-governance-antigravity-cli/package-lock.json b/agent-governance-antigravity-cli/package-lock.json index b948a9df8..89cef3a69 100644 --- a/agent-governance-antigravity-cli/package-lock.json +++ b/agent-governance-antigravity-cli/package-lock.json @@ -1,37 +1,34 @@ { "name": "@microsoft/agent-governance-antigravity-cli", - "version": "4.0.0", + "version": "5.0.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@microsoft/agent-governance-antigravity-cli", - "version": "4.0.0", + "version": "5.0.0", "license": "MIT", "dependencies": { - "@microsoft/agent-governance-sdk": "4.0.0" + "@microsoft/agent-governance-sdk": "5.0.0" }, "bin": { "agt-antigravity": "bin/agt-antigravity.mjs" }, "engines": { "node": ">=20.19.0" - }, - "overrides": { - "js-yaml": "4.2.0" } }, "node_modules/@microsoft/agent-governance-sdk": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/@microsoft/agent-governance-sdk/-/agent-governance-sdk-4.0.0.tgz", - "integrity": "sha512-d6d2MIz3YbNI/7zrfCP9Kwzs1TFtqLka1eIb+n171+7crA/+KC0a2mbJnC5RmJPUKJ2RR+8ts+41/IGDvUFhMg==", + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/@microsoft/agent-governance-sdk/-/agent-governance-sdk-5.0.0.tgz", + "integrity": "sha512-6wh1g1GzEBy5Gq2dUEx5lampUoZaKRtqarQUt7skU63e4/uHi17RpmMm7brLd61iFWXf3N20hE0yZrRNjC439w==", "license": "MIT", "dependencies": { "@noble/ciphers": "2.2.0", "@noble/curves": "2.2.0", "@noble/ed25519": "3.1.0", "@noble/hashes": "2.2.0", - "js-yaml": "4.1.1" + "js-yaml": "5.2.1" }, "engines": { "node": ">=18.0.0" diff --git a/agent-governance-antigravity-cli/package.json b/agent-governance-antigravity-cli/package.json index c0b85f2f3..25212228b 100644 --- a/agent-governance-antigravity-cli/package.json +++ b/agent-governance-antigravity-cli/package.json @@ -33,7 +33,7 @@ "directory": "agent-governance-antigravity-cli" }, "dependencies": { - "@microsoft/agent-governance-sdk": "4.0.0" + "@microsoft/agent-governance-sdk": "5.0.0" }, "overrides": { "js-yaml": "4.2.0" From f6e96b49b7e71db68209b328f58be27cce924255 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 11 Aug 2026 09:09:02 +0000 Subject: [PATCH 3/7] chore(deps): Bump @microsoft/agent-governance-sdk Bumps [@microsoft/agent-governance-sdk](https://github.com/microsoft/agent-governance-toolkit/tree/HEAD/agent-governance-typescript) from 4.0.0 to 5.0.0. - [Release notes](https://github.com/microsoft/agent-governance-toolkit/releases) - [Changelog](https://github.com/microsoft/agent-governance-toolkit/blob/main/CHANGELOG.md) - [Commits](https://github.com/microsoft/agent-governance-toolkit/commits/v5.0.0/agent-governance-typescript) --- updated-dependencies: - dependency-name: "@microsoft/agent-governance-sdk" dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- agent-governance-copilot-cli/package-lock.json | 17 +++++++---------- agent-governance-copilot-cli/package.json | 2 +- 2 files changed, 8 insertions(+), 11 deletions(-) diff --git a/agent-governance-copilot-cli/package-lock.json b/agent-governance-copilot-cli/package-lock.json index e04cf2786..390c56e29 100644 --- a/agent-governance-copilot-cli/package-lock.json +++ b/agent-governance-copilot-cli/package-lock.json @@ -1,37 +1,34 @@ { "name": "@microsoft/agent-governance-copilot-cli", - "version": "4.0.0", + "version": "5.0.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@microsoft/agent-governance-copilot-cli", - "version": "4.0.0", + "version": "5.0.0", "license": "MIT", "dependencies": { - "@microsoft/agent-governance-sdk": "4.0.0" + "@microsoft/agent-governance-sdk": "5.0.0" }, "bin": { "agt-copilot": "bin/agt-copilot.mjs" }, "engines": { "node": ">=22.0.0" - }, - "overrides": { - "js-yaml": "4.2.0" } }, "node_modules/@microsoft/agent-governance-sdk": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/@microsoft/agent-governance-sdk/-/agent-governance-sdk-4.0.0.tgz", - "integrity": "sha512-d6d2MIz3YbNI/7zrfCP9Kwzs1TFtqLka1eIb+n171+7crA/+KC0a2mbJnC5RmJPUKJ2RR+8ts+41/IGDvUFhMg==", + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/@microsoft/agent-governance-sdk/-/agent-governance-sdk-5.0.0.tgz", + "integrity": "sha512-6wh1g1GzEBy5Gq2dUEx5lampUoZaKRtqarQUt7skU63e4/uHi17RpmMm7brLd61iFWXf3N20hE0yZrRNjC439w==", "license": "MIT", "dependencies": { "@noble/ciphers": "2.2.0", "@noble/curves": "2.2.0", "@noble/ed25519": "3.1.0", "@noble/hashes": "2.2.0", - "js-yaml": "4.1.1" + "js-yaml": "5.2.1" }, "engines": { "node": ">=18.0.0" diff --git a/agent-governance-copilot-cli/package.json b/agent-governance-copilot-cli/package.json index 4990ae684..1c8435a2e 100644 --- a/agent-governance-copilot-cli/package.json +++ b/agent-governance-copilot-cli/package.json @@ -33,7 +33,7 @@ "directory": "agent-governance-copilot-cli" }, "dependencies": { - "@microsoft/agent-governance-sdk": "4.0.0" + "@microsoft/agent-governance-sdk": "5.0.0" }, "overrides": { "js-yaml": "4.2.0" From 316c28a0bf738692c34be49ae1a95bfb1fa5a307 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Wed, 12 Aug 2026 12:20:28 -0700 Subject: [PATCH 4/7] docs(deps): audit the sdk 5.0.0 bump in the three CLI packages The vendored-patch-audit gate greps the PR's own diff for the audit doc, and exempts dependabot only for non-major updates, so a semver-major bump opened by dependabot can never satisfy it on its own branch. Carries the three dependabot commits unchanged and adds the audit alongside them. Records that the bump does not clear these packages of a js-yaml advisory: it moves off two HIGH advisories in 4.1.1 onto one in 5.2.1, which is first patched in 5.2.2. Signed-off-by: Imran Siddique --- ...-12-agent-governance-sdk-5-cli-packages.md | 96 +++++++++++++++++++ 1 file changed, 96 insertions(+) create mode 100644 docs/dependency-audits/2026-08-12-agent-governance-sdk-5-cli-packages.md diff --git a/docs/dependency-audits/2026-08-12-agent-governance-sdk-5-cli-packages.md b/docs/dependency-audits/2026-08-12-agent-governance-sdk-5-cli-packages.md new file mode 100644 index 000000000..00384aa28 --- /dev/null +++ b/docs/dependency-audits/2026-08-12-agent-governance-sdk-5-cli-packages.md @@ -0,0 +1,96 @@ +--- +title: agent-governance-sdk 4.0.0 to 5.0.0 in the three CLI packages +last_reviewed: 2026-08-12 +owner: imran-siddique +--- + +# agent-governance-sdk 4.0.0 to 5.0.0 in the three CLI packages + +Covers the lockfile changes in #3686, #3683 and #3681, which bump +`@microsoft/agent-governance-sdk` from `4.0.0` to `5.0.0` in +`agent-governance-claude-code`, `agent-governance-antigravity-cli` and +`agent-governance-copilot-cli` respectively. One document because the three are +the same change to three copies of the same dependency. + +## Which Dependencies Changed And Why + +One first-party direct dependency, and one third-party transitive dependency +underneath it. + +- `@microsoft/agent-governance-sdk` `4.0.0` to `5.0.0` in all three packages. + This closes a version-line inconsistency rather than adopting new + functionality: each of the three CLI packages is already published at + `5.0.0` itself while pinning the `4.0.0` SDK. The `[5.0.0]` CHANGELOG entry + describes the monorepo-wide alignment that moved every first-party Python, + TypeScript, .NET and Rust package from `4.1.0` to `5.0.0` so the released + version line matches the documentation, which already describes Agent Control + Specification as the AGT 5.0 policy layer. +- `js-yaml` `4.1.1` to `5.2.1`, transitively, as the SDK's own pin. This is the + only third-party change the bump carries. Comparing the two published + manifests, `@noble/ciphers` `2.2.0`, `@noble/curves` `2.2.0`, + `@noble/ed25519` `3.1.0`, `@noble/hashes` `2.2.0`, `engines.node >=18.0.0` + and the MIT license are all identical between `4.0.0` and `5.0.0`. +- The lockfiles also drop a second, separate `js-yaml` `4.2.0` entry that the + older tree resolved. After this change each package resolves a single + `js-yaml`. + +Each CLI package declares exactly one dependency, the SDK, so there is no other +surface to consider. + +## Security Advisory Relevance + +**This bump does not clear the CLI packages of a known advisory. It exchanges +two for one, and the incoming version is itself unpatched.** + +Outgoing, `js-yaml` `4.1.1` is in range for two HIGH advisories: + +- `GHSA-5p4m-2wfm-xmqj`, quadratic CPU consumption in `!!omap` resolution, + affecting `>= 4.0.0, < 4.3.1`, first patched in `4.3.1`. +- `GHSA-52cp-r559-cp3m`, YAML merge-key chains forcing quadratic CPU + consumption, affecting `>= 4.0.0, < 4.3.0`, first patched in `4.3.0`. + +Incoming, `js-yaml` `5.2.1` is in range for one HIGH advisory: + +- `GHSA-pm4m-ph32-ghv5`, exponential parsing time in flow collections, + affecting `>= 5.0.0, <= 5.2.1`, **first patched in `5.2.2`**. + +`5.2.1` is clear of `GHSA-724g-mxrg-4qvm` (MODERATE, `<= 5.2.0`) and of +`GHSA-g796-fgmg-93mv` (MODERATE, `<= 5.1.0`), which is presumably why the SDK +landed on that pin. `GHSA-pm4m-ph32-ghv5` was published against the `5.x` line +afterwards. The current `js-yaml` release is `5.2.3`. + +All four advisories are the same class: algorithmic-complexity denial of +service reachable only through parsing attacker-influenced YAML. The direction +of travel is right, from two HIGH to one, and it should not be read as the +bump making these packages advisory-free. + +**Recommended follow-up, out of scope for these three PRs:** repin the SDK's own +`js-yaml` to `>= 5.2.2`. Fixing it in the SDK fixes it once for every consumer, +whereas overriding it in three CLI lockfiles fixes it three times and drifts. +Filed as a separate issue rather than held against a Dependabot PR that cannot +act on it. + +## Breaking Change Risk Assessment + +Low, and lower than the version numbers suggest. + +The SDK major is a version-line alignment, not an API break. The CHANGELOG +entry for `[5.0.0]` records a coordinated renumbering across all first-party +packages plus widening internal cross-package caps from `<5.0` to `<6.0`. It +does not describe a removed or changed API, and the published `4.0.0` and +`5.0.0` manifests agree on runtime requirements, so no consumer is being asked +to move Node versions. + +The genuine major underneath is `js-yaml` `4.x` to `5.x`, and the risk there +sits with the SDK rather than with these three packages. None of the three +depends on `js-yaml` directly, none imports it, and each declares the SDK as +its only dependency, so the parser is reached solely through whatever the SDK +already does with it. A `js-yaml` behaviour change would surface as an SDK +behaviour change, in a version of the SDK that has been published since +2026-08-03. + +Residual risk worth stating plainly: the three packages have been shipping at +`5.0.0` while pinned to the `4.0.0` SDK, so this is the first time the +published CLI version and its published SDK agree. If anything in the v5 +alignment did change behaviour, these are the packages where it shows up first. +That argues for landing the three together rather than one at a time. From b2e56ac6d447d17b76c98fada0a6eab4d87f64af Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Wed, 12 Aug 2026 12:26:28 -0700 Subject: [PATCH 5/7] ci(cspell): ignore GHSA and CVE identifiers, add the omap YAML tag The audit doc above failed spell-check on fragments of GHSA identifiers (xmqj, mxrg, fgmg). Advisory IDs are random strings, so adding each one to the dictionary would grow it by three entries per advisory cited and would recur on every future security audit doc. Matching the identifier shape instead fixes the class. Also adds omap, the YAML ordered-map tag, which is a real term rather than a random one. Signed-off-by: Imran Siddique --- .cspell-repo-terms.txt | 2 ++ .cspell.json | 8 +++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/.cspell-repo-terms.txt b/.cspell-repo-terms.txt index f3be486fa..c5059ba1f 100644 --- a/.cspell-repo-terms.txt +++ b/.cspell-repo-terms.txt @@ -1009,6 +1009,8 @@ hostnames dataprotection # dorny/paths-filter — GitHub Actions dependency used in policy-validation.yml dorny +# YAML ordered-map tag (!!omap), cited in dependency audits +omap writerow wslc x86 diff --git a/.cspell.json b/.cspell.json index 3fbf9c201..7922ecad4 100644 --- a/.cspell.json +++ b/.cspell.json @@ -2,7 +2,9 @@ "version": "0.2", "language": "en", "useGitignore": true, - "dictionaries": ["repo-terms"], + "dictionaries": [ + "repo-terms" + ], "dictionaryDefinitions": [ { "name": "repo-terms", @@ -10,6 +12,10 @@ "addWords": true } ], + "ignoreRegExpList": [ + "/GHSA(-[0-9a-z]{4}){3}/g", + "/CVE-[0-9]{4}-[0-9]{4,}/g" + ], "words": [ "dorny", "subn", From 9907b7a448f78e526f7ac4e3617613e6cb86847f Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Wed, 12 Aug 2026 12:37:45 -0700 Subject: [PATCH 6/7] docs(deps): note that the SDK js-yaml repin already landed on main #3623 moved the SDK source to js-yaml 5.2.3 earlier today, so the recommendation to repin was already stale when written. The residual exposure is in the published 5.0.0 artifact, which pins 5.2.1 and is immutable, so it closes on the next SDK publish rather than by any change to these lockfiles. Signed-off-by: Imran Siddique --- ...-12-agent-governance-sdk-5-cli-packages.md | 20 ++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/docs/dependency-audits/2026-08-12-agent-governance-sdk-5-cli-packages.md b/docs/dependency-audits/2026-08-12-agent-governance-sdk-5-cli-packages.md index 00384aa28..256e98d49 100644 --- a/docs/dependency-audits/2026-08-12-agent-governance-sdk-5-cli-packages.md +++ b/docs/dependency-audits/2026-08-12-agent-governance-sdk-5-cli-packages.md @@ -64,11 +64,21 @@ service reachable only through parsing attacker-influenced YAML. The direction of travel is right, from two HIGH to one, and it should not be read as the bump making these packages advisory-free. -**Recommended follow-up, out of scope for these three PRs:** repin the SDK's own -`js-yaml` to `>= 5.2.2`. Fixing it in the SDK fixes it once for every consumer, -whereas overriding it in three CLI lockfiles fixes it three times and drifts. -Filed as a separate issue rather than held against a Dependabot PR that cannot -act on it. +**The source fix already landed, the published artifact has not.** +`agent-governance-typescript/package.json` on `main` now pins `js-yaml` +`5.2.3`, via #3623 on 2026-08-12. So the SDK source is clear of all four +advisories above. + +What these three packages resolve is the *published* `@microsoft/agent-governance-sdk` +`5.0.0`, released to npm on 2026-08-03, whose manifest pins `js-yaml` `5.2.1`. +That artifact is immutable, so nothing in these lockfiles can reach `5.2.3` +until a new SDK version is published. + +No follow-up PR is needed, and overriding `js-yaml` in three CLI lockfiles +would be the wrong fix: it would pin around the SDK in three places and drift +the moment the next SDK release lands. The residual exposure closes on the next +publish. Recording it here so the gap between "fixed on main" and "fixed in what +consumers install" is visible rather than assumed. ## Breaking Change Risk Assessment From dc83a6ea01ec32a68ce8ff11f6eeed377d14e284 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Thu, 3 Sep 2026 08:37:25 -0700 Subject: [PATCH 7/7] docs(deps): correct the js-yaml audit, and restore the lockfile overrides The audit read the SDK's declared js-yaml and concluded the bump exchanged two HIGH advisories for one. It does not. All three packages declare overrides.js-yaml 4.2.0 in package.json, so every lockfile resolves node_modules/js-yaml to 4.2.0 both before and after the SDK bump. npm ci followed by npm ls js-yaml reports "js-yaml@4.2.0 overridden", and npm audit against this tree reports GHSA-5p4m-2wfm-xmqj and GHSA-52cp-r559-cp3m, the two 4.x HIGH advisories the document claimed were being left behind. GHSA-pm4m-ph32-ghv5 cannot apply, because 5.2.1 is never installed. Also restores the root "overrides" block in the three lockfiles. package.json declares it and main's lockfiles record it; the regenerated lockfiles here dropped it while keeping the 4.2.0 resolution, so the lock no longer recorded the reason for its own pin. npm ci succeeds either way, which is why nothing caught it. Names the conflict with #3843, #3844 and #3875, which move the override to 4.3.1 in the same files and do clear both advisories. Reported by @prayagupa in review. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01BiraRPG9NcLDZsNSmSXxE7 Signed-off-by: Imran Siddique --- .cspell-repo-terms.txt | 2 + .../package-lock.json | 3 + .../package-lock.json | 3 + .../package-lock.json | 3 + ...-12-agent-governance-sdk-5-cli-packages.md | 91 +++++++++---------- 5 files changed, 56 insertions(+), 46 deletions(-) diff --git a/.cspell-repo-terms.txt b/.cspell-repo-terms.txt index 953c4af43..fd000c890 100644 --- a/.cspell-repo-terms.txt +++ b/.cspell-repo-terms.txt @@ -1009,6 +1009,8 @@ hostnames dataprotection # dorny/paths-filter — GitHub Actions dependency used in policy-validation.yml dorny +# GitHub handle, credited in docs/dependency-audits/2026-08-12-agent-governance-sdk-5-cli-packages.md +prayagupa # YAML ordered-map tag (!!omap), cited in dependency audits omap writerow diff --git a/agent-governance-antigravity-cli/package-lock.json b/agent-governance-antigravity-cli/package-lock.json index 89cef3a69..0c0d8ad4c 100644 --- a/agent-governance-antigravity-cli/package-lock.json +++ b/agent-governance-antigravity-cli/package-lock.json @@ -16,6 +16,9 @@ }, "engines": { "node": ">=20.19.0" + }, + "overrides": { + "js-yaml": "4.2.0" } }, "node_modules/@microsoft/agent-governance-sdk": { diff --git a/agent-governance-claude-code/package-lock.json b/agent-governance-claude-code/package-lock.json index fbba77134..833e59cdd 100644 --- a/agent-governance-claude-code/package-lock.json +++ b/agent-governance-claude-code/package-lock.json @@ -13,6 +13,9 @@ }, "engines": { "node": ">=22.0.0" + }, + "overrides": { + "js-yaml": "4.2.0" } }, "node_modules/@microsoft/agent-governance-sdk": { diff --git a/agent-governance-copilot-cli/package-lock.json b/agent-governance-copilot-cli/package-lock.json index 390c56e29..a69239493 100644 --- a/agent-governance-copilot-cli/package-lock.json +++ b/agent-governance-copilot-cli/package-lock.json @@ -16,6 +16,9 @@ }, "engines": { "node": ">=22.0.0" + }, + "overrides": { + "js-yaml": "4.2.0" } }, "node_modules/@microsoft/agent-governance-sdk": { diff --git a/docs/dependency-audits/2026-08-12-agent-governance-sdk-5-cli-packages.md b/docs/dependency-audits/2026-08-12-agent-governance-sdk-5-cli-packages.md index 256e98d49..a5dd6a037 100644 --- a/docs/dependency-audits/2026-08-12-agent-governance-sdk-5-cli-packages.md +++ b/docs/dependency-audits/2026-08-12-agent-governance-sdk-5-cli-packages.md @@ -1,6 +1,6 @@ --- title: agent-governance-sdk 4.0.0 to 5.0.0 in the three CLI packages -last_reviewed: 2026-08-12 +last_reviewed: 2026-09-03 owner: imran-siddique --- @@ -25,60 +25,60 @@ underneath it. TypeScript, .NET and Rust package from `4.1.0` to `5.0.0` so the released version line matches the documentation, which already describes Agent Control Specification as the AGT 5.0 policy layer. -- `js-yaml` `4.1.1` to `5.2.1`, transitively, as the SDK's own pin. This is the - only third-party change the bump carries. Comparing the two published - manifests, `@noble/ciphers` `2.2.0`, `@noble/curves` `2.2.0`, - `@noble/ed25519` `3.1.0`, `@noble/hashes` `2.2.0`, `engines.node >=18.0.0` - and the MIT license are all identical between `4.0.0` and `5.0.0`. -- The lockfiles also drop a second, separate `js-yaml` `4.2.0` entry that the - older tree resolved. After this change each package resolves a single - `js-yaml`. +- `js-yaml`'s *declared* version moves `4.1.1` to `5.2.1`, as the SDK's own pin. + **The installed version does not move.** All three packages declare + `"overrides": { "js-yaml": "4.2.0" }` in `package.json`, on `main` and here, so + each lockfile resolves `node_modules/js-yaml` to `4.2.0` before and after this + bump. Verified with `npm ci` followed by `npm ls js-yaml`, which reports + `js-yaml@4.2.0 overridden` under `@microsoft/agent-governance-sdk@5.0.0`. + Comparing the two published manifests, `@noble/ciphers` `2.2.0`, + `@noble/curves` `2.2.0`, `@noble/ed25519` `3.1.0`, `@noble/hashes` `2.2.0`, + `engines.node >=18.0.0` and the MIT license are all identical between `4.0.0` + and `5.0.0`. So the SDK is the only dependency this bump actually changes. Each CLI package declares exactly one dependency, the SDK, so there is no other surface to consider. ## Security Advisory Relevance -**This bump does not clear the CLI packages of a known advisory. It exchanges -two for one, and the incoming version is itself unpatched.** +**This bump changes nothing about the `js-yaml` these packages install, and so +clears no advisory.** The override holds the parser at `4.2.0` regardless of +what the SDK declares, which means the two HIGH advisories in range before the +bump are still in range after it. -Outgoing, `js-yaml` `4.1.1` is in range for two HIGH advisories: +`npm audit` against this branch's own tree reports both, and no others: -- `GHSA-5p4m-2wfm-xmqj`, quadratic CPU consumption in `!!omap` resolution, - affecting `>= 4.0.0, < 4.3.1`, first patched in `4.3.1`. -- `GHSA-52cp-r559-cp3m`, YAML merge-key chains forcing quadratic CPU +- `GHSA-5p4m-2wfm-xmqj`, HIGH, quadratic CPU consumption in `!!omap` + resolution, affecting `>= 4.0.0, < 4.3.1`, first patched in `4.3.1`. +- `GHSA-52cp-r559-cp3m`, HIGH, YAML merge-key chains forcing quadratic CPU consumption, affecting `>= 4.0.0, < 4.3.0`, first patched in `4.3.0`. -Incoming, `js-yaml` `5.2.1` is in range for one HIGH advisory: +`GHSA-pm4m-ph32-ghv5` (HIGH, `>= 5.0.0, <= 5.2.1`, first patched in `5.2.2`) +does **not** apply here, because `5.2.1` is never installed. Neither do +`GHSA-724g-mxrg-4qvm` or `GHSA-g796-fgmg-93mv`, both scoped to the `5.x` line. -- `GHSA-pm4m-ph32-ghv5`, exponential parsing time in flow collections, - affecting `>= 5.0.0, <= 5.2.1`, **first patched in `5.2.2`**. +All of these are the same class: algorithmic-complexity denial of service +reachable only through parsing attacker-influenced YAML. -`5.2.1` is clear of `GHSA-724g-mxrg-4qvm` (MODERATE, `<= 5.2.0`) and of -`GHSA-g796-fgmg-93mv` (MODERATE, `<= 5.1.0`), which is presumably why the SDK -landed on that pin. `GHSA-pm4m-ph32-ghv5` was published against the `5.x` line -afterwards. The current `js-yaml` release is `5.2.3`. - -All four advisories are the same class: algorithmic-complexity denial of -service reachable only through parsing attacker-influenced YAML. The direction -of travel is right, from two HIGH to one, and it should not be read as the -bump making these packages advisory-free. +**The residual exposure is closed elsewhere, not by this PR.** #3843, #3844 and +#3875 move the override from `4.2.0` to `4.3.1` in the antigravity, Claude Code +and Copilot CLI packages respectively, which clears both advisories above. +Those PRs touch the same `package.json` and `package-lock.json` files as this +one, so they and this PR conflict with each other and should be sequenced +rather than merged in parallel. **The source fix already landed, the published artifact has not.** -`agent-governance-typescript/package.json` on `main` now pins `js-yaml` -`5.2.3`, via #3623 on 2026-08-12. So the SDK source is clear of all four -advisories above. - -What these three packages resolve is the *published* `@microsoft/agent-governance-sdk` -`5.0.0`, released to npm on 2026-08-03, whose manifest pins `js-yaml` `5.2.1`. -That artifact is immutable, so nothing in these lockfiles can reach `5.2.3` -until a new SDK version is published. - -No follow-up PR is needed, and overriding `js-yaml` in three CLI lockfiles -would be the wrong fix: it would pin around the SDK in three places and drift -the moment the next SDK release lands. The residual exposure closes on the next -publish. Recording it here so the gap between "fixed on main" and "fixed in what -consumers install" is visible rather than assumed. +`agent-governance-typescript/package.json` on `main` pins `js-yaml` `5.2.3`, +via #3623 on 2026-08-12, so the SDK source is clear. What these three packages +resolve is the *published* `@microsoft/agent-governance-sdk` `5.0.0`, released +to npm on 2026-08-03, whose manifest pins `js-yaml` `5.2.1`. That artifact is +immutable. It is also moot while the override is in place, which is the point: +these packages have not been exposed to the `5.x` advisory at any time. + +Recording it here so the gap between what the SDK declares and what consumers +install is visible rather than assumed. An earlier revision of this document +read the declared version and concluded the bump exchanged two HIGH advisories +for one. That was wrong, and @prayagupa caught it in review. ## Breaking Change Risk Assessment @@ -91,13 +91,12 @@ does not describe a removed or changed API, and the published `4.0.0` and `5.0.0` manifests agree on runtime requirements, so no consumer is being asked to move Node versions. -The genuine major underneath is `js-yaml` `4.x` to `5.x`, and the risk there -sits with the SDK rather than with these three packages. None of the three +The genuine major underneath, `js-yaml` `4.x` to `5.x`, **is not reached**. +The override holds the installed parser at `4.2.0`, so the SDK's move to a +`5.x` pin has no runtime effect in these three packages. None of the three depends on `js-yaml` directly, none imports it, and each declares the SDK as its only dependency, so the parser is reached solely through whatever the SDK -already does with it. A `js-yaml` behaviour change would surface as an SDK -behaviour change, in a version of the SDK that has been published since -2026-08-03. +already does with it, at the version the override selects. Residual risk worth stating plainly: the three packages have been shipping at `5.0.0` while pinned to the `4.0.0` SDK, so this is the first time the