[dependabot]

Bumps compose-agentsmd from 3.5.1 to 7.0.1.

Release notes

Sourced from compose-agentsmd's releases.

compose-agentsmd 7.0.1

7.0.1

• Clarified tool-rule wording for the \sources\ ruleset format.
• Replaced legacy-looking singular \source\ wording with GitHub source workspace wording.

compose-agentsmd 7.0.0

7.0.0

• Breaking change: rulesets now use \sources\ plus \profile.
• Removed support for legacy \source, \domains, and \�xtra\ ruleset keys.
• Profiles are resolved from each source's \�gent-profiles.json.
• Multiple sources are composed in declared order, enabling public/private overlays.

v6.0.5

• Clarify the compose-agentsmd session gate so it runs once per externally supplied human/operator instruction and does not repeat for generated continuations, retries, or resumed execution. - Add regression coverage for the session gate wording. - Update the lockfile with npm audit fix to remediate a critical Vitest advisory.

v6.0.4

Release v6.0.4

v6.0.3

Full Changelog: metyatech/compose-agentsmd@v6.0.2...v6.0.3

v6.0.2

Full Changelog: metyatech/compose-agentsmd@v6.0.1...v6.0.2

v6.0.1

Full Changelog: metyatech/compose-agentsmd@v5.0.0...v6.0.1

v5.0.0

• Breaking change: switched global-rule budget checks, schema fields, warnings, and JSON output from line counts to o200k_base token counts (budget.totalTokens / budget.moduleTokens).
• Updated README and tests to match the token-based budget model and new default thresholds.
• Hardened apply-rules fallback handling for partial clone failures.
• Remediated the remaining npm development dependency advisories via npm audit fix.

v4.0.0

4.0.0 - 2026-03-19

• Breaking change: compose now writes shared rules/global content to user-global instruction files for Codex, Claude, Gemini CLI, and Copilot instead of embedding those rules into every repository AGENTS.md.
• Repository output now contains only repository-facing instructions (domains + extra) plus tool rules, while CLAUDE.md continues to import the repository AGENTS.md.
• Diff output now reports both repository-side and global-side changes.
• Updated the CLI JSON output, schema text, README, and usage help to match the split-output behavior.
• Bumped the package description to reflect repository-local and user-global composition.
• Updated this repository's pre-commit hook to run npm run compose so it uses the checked-out implementation when regenerating instruction files.
• Remediated a high-severity development dependency advisory via npm audit fix.

Changelog

Sourced from compose-agentsmd's changelog.

7.0.1 - 2026-07-02

• Clarified tool-rule wording for the sources ruleset format.
• Replaced legacy-looking singular source wording with GitHub source workspace wording.

7.0.0 - 2026-07-02

• Breaking change: rulesets now use sources plus profile.
• Removed support for legacy source, domains, and extra ruleset keys.
• Profiles are resolved from each source's agent-profiles.json.
• Multiple sources are composed in declared order, enabling public/private overlays.

6.0.5 - 2026-06-03

• Clarified the session gate so compose-agentsmd runs once per externally supplied human/operator instruction and is not rerun for generated continuations, retries, or resumed execution.
• Added regression coverage for the session gate wording.
• Updated the lockfile with npm audit fix to remediate a critical Vitest advisory.

6.0.4 - 2026-05-28

• Fixed the GitHub Actions npm trusted-publishing workflow configuration.

6.0.3 - 2026-05-28

• Fix GitHub Actions publish workflow to correctly pass the npm authentication token.

6.0.2 - 2026-05-28

• Added GitHub Actions workflow for automated npm trusted publishing (OIDC / provenance).
• Updated documentation and changelog tracking for recent patch releases.

6.0.1 - 2026-05-28

• Security: updated fast-uri dependency to remediate a high-severity vulnerability.

6.0.0 - 2026-04-09

• Breaking change: split the global-rule budget into a hard total budget and an advisory per-module review threshold. The total budget remains a violation when exceeded; the per-module threshold is now an advisory that triggers a review prompt rather than a violation.
• Renamed BudgetCheckResult.exceeded to totalExceeded and added moduleReviewTriggered. JSON output reflects the rename.
• Renamed the internal helper formatBudgetWarning to formatBudgetReport, which now emits ⚠ Global rules budget exceeded only on total exceedance and a separate ℹ Modules over per-module review threshold advisory on per-module overage. Both can be suppressed with --quiet.

... (truncated)

Commits

• de68f66 Release compose-agentsmd 7.0.1
• 9dda51c Use Node 24 for trusted npm publishing
• d008ce1 Release compose-agentsmd 7.0.0
• b763aff Use shared compose-agentsmd profile
• c8ab5e0 Redesign rulesets around sources and profiles
• 2ca0396 Opt GitHub Actions into Node 24 runtime
• d4a0d9f Release compose-agentsmd 6.0.5
• 7c8214d Clarify compose-agentsmd session gate scope
• 3e8f3ac fix(ci): remove registry-url from setup-node to allow npm OIDC auth
• 546fc1a 6.0.4
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for compose-agentsmd since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.