[dependabot]

Bumps compose-agentsmd from 3.5.1 to 6.0.0.

Release notes

Sourced from compose-agentsmd's releases.

v5.0.0

• Breaking change: switched global-rule budget checks, schema fields, warnings, and JSON output from line counts to o200k_base token counts (budget.totalTokens / budget.moduleTokens).
• Updated README and tests to match the token-based budget model and new default thresholds.
• Hardened apply-rules fallback handling for partial clone failures.
• Remediated the remaining npm development dependency advisories via npm audit fix.

v4.0.0

4.0.0 - 2026-03-19

• Breaking change: compose now writes shared rules/global content to user-global instruction files for Codex, Claude, Gemini CLI, and Copilot instead of embedding those rules into every repository AGENTS.md.
• Repository output now contains only repository-facing instructions (domains + extra) plus tool rules, while CLAUDE.md continues to import the repository AGENTS.md.
• Diff output now reports both repository-side and global-side changes.
• Updated the CLI JSON output, schema text, README, and usage help to match the split-output behavior.
• Bumped the package description to reflect repository-local and user-global composition.
• Updated this repository's pre-commit hook to run npm run compose so it uses the checked-out implementation when regenerating instruction files.
• Remediated a high-severity development dependency advisory via npm audit fix.

Changelog

Sourced from compose-agentsmd's changelog.

6.0.0 - 2026-04-09

• Breaking change: split the global-rule budget into a hard total budget and an advisory per-module review threshold. The total budget remains a violation when exceeded; the per-module threshold is now an advisory that triggers a review prompt rather than a violation.
• Renamed BudgetCheckResult.exceeded to totalExceeded and added moduleReviewTriggered. JSON output reflects the rename.
• Renamed the internal helper formatBudgetWarning to formatBudgetReport, which now emits ⚠ Global rules budget exceeded only on total exceedance and a separate ℹ Modules over per-module review threshold advisory on per-module overage. Both can be suppressed with --quiet.
• Raised default budgets to DEFAULT_TOTAL_BUDGET = 8000 and DEFAULT_MODULE_BUDGET = 800, sized to fit a realistic invariant density (~80–120 invariants × ~30–50 tokens) plus structural and growth headroom while staying a small fraction of the smallest target model's effective system-prompt window. Documented derivation in source comments.
• README and tests updated to reflect the new defaults, semantics, and report format.

5.0.0 - 2026-04-02

• Breaking change: switched global-rule budget checks, schema fields, warnings, and JSON output from line counts to o200k_base token counts (budget.totalTokens / budget.moduleTokens).
• Updated README and tests to match the token-based budget model and new default thresholds.
• Hardened apply-rules fallback handling for partial clone failures.
• Remediated the remaining npm development dependency advisories via npm audit fix.

4.0.0 - 2026-03-19

• Breaking change: compose now writes shared rules/global content to user-global instruction files for Codex, Claude, Gemini CLI, and Copilot instead of embedding those rules into every repository AGENTS.md.
• Repository output now contains only repository-facing instructions (domains + extra) plus tool rules, while CLAUDE.md continues to import the repository AGENTS.md.
• Diff output now reports both repository-side and global-side changes.
• Updated the CLI JSON output, schema text, README, and usage help to match the split-output behavior.
• Bumped the package description to reflect repository-local and user-global composition.
• Updated this repository's pre-commit hook to run npm run compose so it uses the checked-out implementation when regenerating instruction files.
• Remediated a high-severity development dependency advisory via npm audit fix.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #5.