[dependabot]

Bumps compose-agentsmd from 3.5.1 to 6.0.5.

Release notes

Sourced from compose-agentsmd's releases.

v6.0.5

• Clarify the compose-agentsmd session gate so it runs once per externally supplied human/operator instruction and does not repeat for generated continuations, retries, or resumed execution. - Add regression coverage for the session gate wording. - Update the lockfile with npm audit fix to remediate a critical Vitest advisory.

v6.0.4

Release v6.0.4

v6.0.3

Full Changelog: metyatech/compose-agentsmd@v6.0.2...v6.0.3

v6.0.2

Full Changelog: metyatech/compose-agentsmd@v6.0.1...v6.0.2

v6.0.1

Full Changelog: metyatech/compose-agentsmd@v5.0.0...v6.0.1

v5.0.0

• Breaking change: switched global-rule budget checks, schema fields, warnings, and JSON output from line counts to o200k_base token counts (budget.totalTokens / budget.moduleTokens).
• Updated README and tests to match the token-based budget model and new default thresholds.
• Hardened apply-rules fallback handling for partial clone failures.
• Remediated the remaining npm development dependency advisories via npm audit fix.

v4.0.0

4.0.0 - 2026-03-19

• Breaking change: compose now writes shared rules/global content to user-global instruction files for Codex, Claude, Gemini CLI, and Copilot instead of embedding those rules into every repository AGENTS.md.
• Repository output now contains only repository-facing instructions (domains + extra) plus tool rules, while CLAUDE.md continues to import the repository AGENTS.md.
• Diff output now reports both repository-side and global-side changes.
• Updated the CLI JSON output, schema text, README, and usage help to match the split-output behavior.
• Bumped the package description to reflect repository-local and user-global composition.
• Updated this repository's pre-commit hook to run npm run compose so it uses the checked-out implementation when regenerating instruction files.
• Remediated a high-severity development dependency advisory via npm audit fix.

Changelog

Sourced from compose-agentsmd's changelog.

6.0.5 - 2026-06-03

• Clarified the session gate so compose-agentsmd runs once per externally supplied human/operator instruction and is not rerun for generated continuations, retries, or resumed execution.
• Added regression coverage for the session gate wording.
• Updated the lockfile with npm audit fix to remediate a critical Vitest advisory.

6.0.4 - 2026-05-28

• Fixed the GitHub Actions npm trusted-publishing workflow configuration.

6.0.3 - 2026-05-28

• Fix GitHub Actions publish workflow to correctly pass the npm authentication token.

6.0.2 - 2026-05-28

• Added GitHub Actions workflow for automated npm trusted publishing (OIDC / provenance).
• Updated documentation and changelog tracking for recent patch releases.

6.0.1 - 2026-05-28

• Security: updated fast-uri dependency to remediate a high-severity vulnerability.

6.0.0 - 2026-04-09

• Breaking change: split the global-rule budget into a hard total budget and an advisory per-module review threshold. The total budget remains a violation when exceeded; the per-module threshold is now an advisory that triggers a review prompt rather than a violation.
• Renamed BudgetCheckResult.exceeded to totalExceeded and added moduleReviewTriggered. JSON output reflects the rename.
• Renamed the internal helper formatBudgetWarning to formatBudgetReport, which now emits ⚠ Global rules budget exceeded only on total exceedance and a separate ℹ Modules over per-module review threshold advisory on per-module overage. Both can be suppressed with --quiet.
• Raised default budgets to DEFAULT_TOTAL_BUDGET = 8000 and DEFAULT_MODULE_BUDGET = 800, sized to fit a realistic invariant density (~80–120 invariants × ~30–50 tokens) plus structural and growth headroom while staying a small fraction of the smallest target model's effective system-prompt window. Documented derivation in source comments.
• README and tests updated to reflect the new defaults, semantics, and report format.

5.0.0 - 2026-04-02

• Breaking change: switched global-rule budget checks, schema fields, warnings, and JSON output from line counts to o200k_base token counts

... (truncated)

Commits

• d4a0d9f Release compose-agentsmd 6.0.5
• 7c8214d Clarify compose-agentsmd session gate scope
• 3e8f3ac fix(ci): remove registry-url from setup-node to allow npm OIDC auth
• 546fc1a 6.0.4
• 2e1e556 fix(release): use passwordless OIDC publish
• 65f3a1a 6.0.3
• a4b8a87 fix(release): correctly pass npm token in publish workflow
• 15994bb 6.0.2
• 9e3df8d chore(release): prepare 6.0.2 with publish workflow
• 322ca7f 6.0.1
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for compose-agentsmd since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #11.