chore(deps): bump @microsoft/agent-governance-sdk from 4.0.0 to 5.0.0 in /agent-governance-antigravity-cli

[dependabot]

Bumps @microsoft/agent-governance-sdk from 4.0.0 to 5.0.0.

Release notes

Sourced from @​microsoft/agent-governance-sdk's releases.

v4.1.0

What's New in v4.1.0

Agent OS (Nexus)

• Ed25519 signature verification for agent registration and deregistration
• Escrow signing support in ProofOfOutcome
• Crewai adapter fixes

Policy Engine

• Dynamic policy conditions with time-based and cost-aware rules
• Updated Cedar policy versions
• agt-policies 5.0.0

All Packages

See CHANGELOG for full details.

Changelog

Sourced from @​microsoft/agent-governance-sdk's changelog.

[5.0.0] - 2026-06-25

Changed

• BREAKING: Monorepo-wide v5 alignment. Bumped all first-party Python, TypeScript, .NET, and Rust packages from 4.1.0 to 5.0.0 (plus the top-level VERSION file, the docs/ARCHITECTURE.md banner, and the Claude Code plugin/marketplace manifests), and widened internal cross-package version caps from <5.0 to <6.0. This aligns the released version line with the documentation, which already describes Agent Control Specification (ACS) as the AGT 5.0 policy layer (ACS landed in #2747). Third-party dependency caps, the independently-versioned policy-engine/ ACS engine (0.3.1-beta), and the separately-tagged Go module are unchanged; lockfiles regenerate at publish time.

Added

• Agent sandbox nono provider — added NonoSandboxProvider to agt-sandbox, a Linux/macOS kernel-enforced sandbox backend via the nono-py bindings (Landlock / Seatbelt) with filtered egress, native runtime gating, and AST pre-scan; install with pip install "agt-sandbox[nono]".
• Command denylist enforcement in RingEnforcer — added check_command() method to RingEnforcer that validates subprocess commands against a global DENIED_COMMANDS list with case-insensitive matching and shell metacharacter stripping (;, &, |) to prevent injection bypasses. Includes comprehensive test coverage in tests/unit/test_command_denylist.py.

Fixed

• agent-os policy evaluator - folder-scoped backend decisions now include policy, backend, evaluation_ms, context_snapshot, and timestamp fields in audit_entry, matching the flat evaluation path and eliminating the parity gap when an external backend (OPA / Cedar) returns a decision under folder-scoped evaluation (#2861).

Commits

• dbf6d2a chore(deps-dev): Bump postcss (#3424)
• 049c2b0 chore(deps): Bump axios in /agent-governance-typescript/agent-os-vscode (#3372)
• f731dc5 chore(deps-dev): Bump eslint in /agent-governance-typescript (#3218)
• 63a2b81 chore(deps-dev): bump @​types/node in /agent-governance-typescript (#3270)
• c159b54 chore(deps-dev): bump @​typescript-eslint/parser (#3275)
• f27a41d chore(deps): bump js-yaml in /agent-governance-typescript (#3277)
• 8b9a074 chore(deps): bump js-yaml in /agent-governance-typescript (#3223)
• 1133147 chore(deps-dev): bump @​typescript-eslint/parser (#3215)
• c89b742 chore(deps-dev): bump @​types/node in /agent-governance-typescript (#3211)
• e5693cb chore: bump monorepo version 4.1.0 -> 5.0.0 (#3191)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@microsoft/agent-governance-sdk	5.0.0	🟢 7.7	Details Check Score Reason Code-Review 🟢 8 Found 7/8 approved changesets -- score normalized to 8 Maintained 🟢 10 30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Dependency-Update-Tool 🟢 10 update tool detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices 🟢 5 badge detected: Passing Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 SAST 🟢 9 SAST tool detected but not run on all commits Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Packaging 🟢 10 packaging workflow detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 17 contributing companies or organizations Vulnerabilities ⚠️ 0 59 existing vulnerabilities detected

Scanned Files

• agent-governance-antigravity-cli/package-lock.json

[github-actions]

📦 Dependency diff (SBOM)

Comparing main → dependabot/npm_and_yarn/agent-governance-antigravity-cli/microsoft/agent-governance-sdk-5.0.0.

Summary: ➕ 0 added · ➖ 0 removed · 🔄 1 bumped

🔄 Bumped

npm (1)

Package	From	To
%40microsoft/agent-governance-antigravity-cli	4.0.0	5.0.0

[Imran Siddique (imran-siddique)]

Blocked by Dependency Audit Trail, and it cannot clear on this branch.

scripts/ci/vendored-patch-audit.sh exempts Dependabot only for non-major updates, and this run carries DEPENDABOT_UPDATE_TYPE: version-update:semver-major. The gate then looks for an audit doc in the PR's own diff, which Dependabot does not write. So a semver-major Dependabot PR can never satisfy it unaided, and a separate doc PR would not satisfy it either.

I have opened #3721, which carries this commit cherry-picked unchanged (lockfile and package.json byte-identical, Signed-off-by: dependabot[bot] preserved) together with the two sibling bumps and the audit doc. It is green.

One thing from the audit worth knowing before it lands: the bump does not clear these packages of a js-yaml advisory. It moves off two HIGH advisories in 4.1.1 onto GHSA-pm4m-ph32-ghv5 in 5.2.1, which is first patched in 5.2.2. The durable fix is repinning js-yaml in the SDK rather than in three CLI lockfiles.

No action needed here. A maintainer can close this in favour of #3721.