chore(deps): update cmcp-runtime requirement from >=0.4.1 to >=0.5.0

[dependabot]

Updates the requirements on cmcp-runtime to permit the latest version.

Release notes

Sourced from cmcp-runtime's releases.

cmcp 0.5.0

Security release. Full detail in CHANGELOG.md.

The one to read first

Cross-boundary compliance recording was dead for HIPAA PHI, PCI data and MNPI.

call_log._HIGH_SENSITIVITY_DOMAINS decides whether a call leaving a domain is recorded as a boundary crossing in the TRACE claim. It was the literal {"pii", "phi", "pci", "restricted"}, while the catalog schema permitted {hipaa_phi, pci_data, mnpi, pii, internal, external, public}.

The two sets overlapped on pii alone. phi, pci and restricted could never appear as a compliance_domain, and the three most regulated domains the field exists to express never matched anything. A session that read HIPAA PHI and then called an external tool recorded no crossing.

The set is now derived from a single COMPLIANCE_DOMAINS vocabulary. Legacy spellings stay in it, so no deployment loses an event.

Also fixed

• Policy bundle hash now uses RFC 8785 (GHSA-wh6r-6j4v-p4p6), as docs/spec/cedar-policy.md §1 always specified.
• cert-pinned rotation mode is reachable. The schema's additionalProperties: false rejected the very field the docs told operators to set, so every deployment ran the weaker key-pinned default with no way to opt out.
• compliance_domain is deployment extensible, mirroring sensitivity_level.
• Credential redaction is deny-by-default. It covered only Authorization, while the same request carries OPAQUE_API_KEY.
• Least-privilege CI. All 24 action references pin a commit SHA, four workflows gained a permissions: floor, four ${{ }} interpolations left run: blocks.

Upgrading

Two changes you may see:

• Policy bundles carrying non-ASCII text or float-typed numbers change hash and need re-pinning. ASCII-only bundles are byte-identical, which is the common case. A mismatch fails at startup with both values named.
• Catalogs may now use deployment-declared compliance domains via sensitivity.compliance_domains in config. Existing catalogs are unaffected.

Changelog

Sourced from cmcp-runtime's changelog.

[0.5.0] - 2026-09-05

Security

• Cross-boundary compliance recording was dead for HIPAA PHI, PCI data and MNPI. call_log._HIGH_SENSITIVITY_DOMAINS, which decides whether a call leaving a domain is recorded as a boundary crossing in the TRACE claim, was the literal {"pii", "phi", "pci", "restricted"}, while the catalog schema permitted {hipaa_phi, pci_data, mnpi, pii, internal, external, public}. The two overlapped on pii alone: phi, pci and restricted could never appear as a compliance_domain, and the three most regulated domains the field can express never matched. A session that read HIPAA PHI and then called an external tool recorded no crossing. The set is now derived from a single COMPLIANCE_DOMAINS vocabulary beside SENSITIVITY_ORDER; the legacy spellings stay in it so no deployment regresses.

• Policy bundle hash now uses RFC 8785 (GHSA-wh6r-6j4v-p4p6). docs/spec/cedar-policy.md §1 defines canonical_json as RFC 8785 and the implementation used json.dumps(sort_keys=True, ensure_ascii=True). The two agree for ASCII-only, integer-only bundles and diverge on non-ASCII strings and float-typed numbers, so an independent implementation following the spec could not reproduce this gateway's startup gate. Breaking for bundles carrying non-ASCII text or float-typed numbers: those change hash and need re-pinning. ASCII-only bundles are byte-identical.

• _redact_auth_headers is deny-by-default. It redacted only Authorization, while the same request is configured with OPAQUE_API_KEY, so a deployment carrying it in x-api-key or a cookie logged it in clear on the debug path.

• Least-privilege CI. All 24 third-party action references pin a commit SHA rather than a mutable tag, including the release-path steps that hold registry credentials, signing keys and id-token: write. Four workflows gained a top-level permissions: floor, and four ${{ }} interpolations moved out of run: blocks into env:.

Added

• cert-pinned rotation mode is reachable. server.rotation_mode has always been read by the loader and used by the proxy, and docs/spec/tool-identity.md documents "rotation_mode": "cert-pinned" as the catalog field an operator sets. The catalog schema declared the server block additionalProperties: false and never listed it, so a catalog following the documentation was rejected at load and every deployment ran the weaker key-pinned default with no way to opt out.

• compliance_domain is deployment extensible. It was a closed seven-value enum, so a deployment with its own classification could not express it and the catalog would not load. Validation moves to load time against the built-in vocabulary plus sensitivity.compliance_domains in config, mirroring what

... (truncated)

Commits

• d03b9af fix: unbreak release.yml and adopt agent-manifest 0.12.0 (#616)
• 6e5d0ce release: cmcp 0.5.0 (#615)
• 126ec21 fix(compliance): make compliance_domain extensible and fix the dead boundary ...
• 40c2ae0 Fix cMCP tutorial trust assumptions and clarify the reader path (#611)
• 30679cb fix(policy): compute the bundle hash with RFC 8785, as the spec requires (#612)
• df93e68 fix(catalog): make cert-pinned rotation mode reachable (#610)
• cdaf97c fix(security): pin actions to SHAs, scope tokens, broaden credential redactio...
• e571c9f fix(verify): bind platform evidence to the TRACE nonce (#608)
• 7178c40 fix(verify): read platform evidence from the cmcp envelope on every branch (#...
• e55f577 feat(ci): vouch first-time contributors, and say the rule about understanding...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)