Skip to content

Agent Gate

v0.4.0 Breaking

This release includes 3 breaking changes for platform teams planning a safe upgrade.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-agents ai-code-review ci-cd code-review coding-agents security
+4 more
devtools policy-as-code pull-requests supply-chain-security

Affected surfaces

breaking_upgrade

Summary

AI summary

Updates Highlights, migration-v0.4.0.md, and integrations/claude-code.md across a mixed release.

Full changelog

MergeWarden v0.4.0 Release Notes

MergeWarden v0.4.0 renames the project from Agent Gate and publishes the CLI
under the unscoped npm name mergewarden. The GitHub repository is now
sjh9714/mergewarden; old repository URLs redirect. The scoped package
@jinhyuk9714/agent-gate remains at v0.3.1 and is deprecated.

Try It

npx --yes [email protected] scan owner/repo#123

The CLI analyzes public pull requests without cloning, checking out,
installing, or executing target-repository code. Private repositories and
higher GitHub API limits use GH_TOKEN, with GITHUB_TOKEN as the fallback.

Highlights

  • Rename the base-branch policy file to mergewarden.yml and the PR body
    contract marker to mergewarden-contract. This is a clean break with no
    compatibility alias; see the v0.4.0 migration guide.
  • Rename default report outputs to mergewarden-report.json and
    mergewarden-report.md. Finding IDs keep the agf_ prefix so existing
    waivers remain valid.
  • Reposition the README around agent-specific boundaries: declared PR scope,
    agent-control-plane drift, and agentic workflow injection.
  • Add integration guides for gating Claude Code
    and Codex pull requests.
  • Publish the AI-agent PR scan methodology used for the
    v0.4.0 launch study.

The signed v0.3.x tags remain immutable. v0.4.0 is a new source, tarball, and
provenance identity under the MergeWarden name.

See the v0.4.0 migration guide,
CLI reference, and release checklist.

Breaking Changes

  • Project renamed from `Agent Gate` to `MergeWarden`; npm package is now unscoped `mergewarden` and GitHub repository moved to `sjh9714/mergewarden`. The scoped package `@jinhyuk9714/agent-gate` remains at v0.3.1 and is deprecated.
  • Base-branch policy file renamed from the previous name to `mergewarden.yml`; PR body contract marker changed from the old name to `mergewarden-contract`. No compatibility alias provided; migration required (see migration-v0.4.0.md).
  • Default report output filenames changed to `mergewarden-report.json` and `mergewarden-report.md`. Existing waivers remain valid because finding IDs keep the `agf_` prefix.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Agent Gate

Get notified when new releases ship.

Sign up free

About Agent Gate

All releases →

Related context

Earlier breaking changes

  • v0.3.1 Breaks unscoped `agent-gate` package name; now scoped as `@jinhyuk9714/agent-gate`.

Beta — feedback welcome: [email protected]