This release includes 3 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+4 more
Affected surfaces
Summary
AI summaryUpdates Highlights, migration-v0.4.0.md, and integrations/claude-code.md across a mixed release.
Full changelog
MergeWarden v0.4.0 Release Notes
MergeWarden v0.4.0 renames the project from Agent Gate and publishes the CLI
under the unscoped npm name mergewarden. The GitHub repository is now
sjh9714/mergewarden; old repository URLs redirect. The scoped package
@jinhyuk9714/agent-gate remains at v0.3.1 and is deprecated.
Try It
npx --yes [email protected] scan owner/repo#123
The CLI analyzes public pull requests without cloning, checking out,
installing, or executing target-repository code. Private repositories and
higher GitHub API limits use GH_TOKEN, with GITHUB_TOKEN as the fallback.
Highlights
- Rename the base-branch policy file to
mergewarden.ymland the PR body
contract marker tomergewarden-contract. This is a clean break with no
compatibility alias; see the v0.4.0 migration guide. - Rename default report outputs to
mergewarden-report.jsonand
mergewarden-report.md. Finding IDs keep theagf_prefix so existing
waivers remain valid. - Reposition the README around agent-specific boundaries: declared PR scope,
agent-control-plane drift, and agentic workflow injection. - Add integration guides for gating Claude Code
and Codex pull requests. - Publish the AI-agent PR scan methodology used for the
v0.4.0 launch study.
The signed v0.3.x tags remain immutable. v0.4.0 is a new source, tarball, and
provenance identity under the MergeWarden name.
See the v0.4.0 migration guide,
CLI reference, and release checklist.
Breaking Changes
- Project renamed from `Agent Gate` to `MergeWarden`; npm package is now unscoped `mergewarden` and GitHub repository moved to `sjh9714/mergewarden`. The scoped package `@jinhyuk9714/agent-gate` remains at v0.3.1 and is deprecated.
- Base-branch policy file renamed from the previous name to `mergewarden.yml`; PR body contract marker changed from the old name to `mergewarden-contract`. No compatibility alias provided; migration required (see migration-v0.4.0.md).
- Default report output filenames changed to `mergewarden-report.json` and `mergewarden-report.md`. Existing waivers remain valid because finding IDs keep the `agf_` prefix.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Agent Gate
All releases →Beta — feedback welcome: [email protected]