chore(deps): bump githubnext/gh-aw from 0.34.5 to 0.37.0

[dependabot]

Bumps githubnext/gh-aw from 0.34.5 to 0.37.0.

Release notes

Sourced from githubnext/gh-aw's releases.

gh-aw 0.36.0

🌟 Release Highlights

This release brings significant improvements to network security, agent workflows, and developer experience with 94 merged pull requests.

✨ What's New

Network Security Enhancements

• Domain blocklist support - Block specific domains or ecosystems (e.g., python, node) while allowing others via network.blocked and --block-domains flag (#9063)
• Protocol-specific filtering - Restrict domains to HTTP-only or HTTPS-only with http:// and https:// prefixes (#9062)
• Localhost rewriting - Automatic localhost → host.docker.internal for MCP servers when firewall is enabled (#9281)

Agent Session Improvements

• New terminology - Migrated from "agent task" to "agent session" with automatic codemod support via gh aw fix (#9214)
• Session state logging - Copy Copilot session files to workflow artifacts for debugging (#9272)
• Conversation markdown - Transform Copilot conversation.md headers for step summaries (#9301)

Workflow System Enhancements

• Runtime imports - Import steps from external files with @import: path/to/file.md and automatic checkout (#9306, #9315, #9316)
• Missing data handler - New missing_data safe output type for reporting data gaps (#9324)
• Integrated missing_tool - Refactored to safe output handler pattern (#9322)

Developer Experience

• Firewall log summaries - Use awf logs summary for CI reports (#9055)
• Action path isolation - Move setup/compiler from /tmp/gh-aw to /opt/gh-aw for read-only agent access (#9273)
• Better error messages - Simplified compiler errors and removed regex validation noise (#9309)

🐛 Key Bug Fixes

Security Fixes

• Fixed template injection vulnerabilities by moving user inputs to environment variables (#9147, #9124)
• Resolved path traversal false positives in workflow validation (#9308, #9294)
• Removed dangerous write permissions feature flag from compiler errors (#9275)

Workflow Compilation

• Fixed invalid YAML from template conditionals in heredocs (#9289)
• Relaxed firewall log field validation to match JavaScript parser (#9227)
• Fixed read-only permissions with safe-outputs jobs (#9191)

MCP & Tools

• Skip tools validation for custom agents with array-format tools (#9307)
• Remove command stdio server support per MCP v1.0.0 specification (#9304)
• Add create_project_status_update to handler config generation (#9169)

⚡ Version Updates

• Copilot CLI → 0.0.375 with conversation markdown support (#9271)
• Codex → 0.79.0 with improved session handling (#9271)
• AWF (firewall) → v0.8.2 (#9163)
• actions/upload-artifact → v6.0.0 (#9302)

... (truncated)

Changelog

Sourced from githubnext/gh-aw's changelog.

Changelog

All notable changes to this project will be documented in this file.

v0.36.0 - 2026-01-08

Features

Migrate terminology from "agent task" to "agent session".

This change updates the CLI, JSON schemas, codemods, docs, and tests to use the new "agent session" terminology. A codemod (gh aw fix) is included to automatically migrate workflows; the old create-agent-task key remains supported with a deprecation warning to preserve backward compatibility.

Bug Fixes

Add domain blocklist support via --block-domains flag.

This change adds support for specifying blocked domains in workflow frontmatter and passes the --block-domains flag to Copilot/Claude/Codex engines during compilation. Includes parser updates, unit and integration tests, and documentation updates.

Add domain blocklist support via the --block-domains flag and the

blocked frontmatter field. This enables specifying domains or ecosystem identifiers to block in workflows and ensures the flag is only added when blocked domains are present.

Supported engines: Copilot, Claude, Codex.

Ref: githubnext/gh-aw#9063

Use awf logs summary to generate the CI firewall report and print it to the GitHub Actions step summary.

• Adds continue-on-error: true to the "Firewall summary" step so CI does not fail when generating reports.
• Recompiles workflow lock files and merges main to pick up latest changes.
• Fixes githubnext/gh-aw#9041

Bump gh-aw-firewall (AWF) default binary version to v0.8.2.

Updated the DefaultFirewallVersion constant, corresponding test expectations, updated documentation, and recompiled workflow lock files.

Bump Codex CLI default version to 0.78.0.

This updates the repository to reference @openai/codex@0.78.0 (used by workflows), and aligns the DefaultCodexVersion constant and related tests/docs with the new version. Changes include security hardening, reliability fixes, and UX improvements.

Files affected in the PR: constants, tests, docs, and recompiled workflow lock files.

... (truncated)

Commits

• f096b8b Add issue grouping support to create-issue safe-output (#10497)
• bfbea6b Add Pelis Agent Factory documentation to create-agentic-workflow templates (#...
• 74c3642 fix: Copy gh-aw binary to /opt/gh-aw for agentic-workflows MCP server contain...
• 3fc1435 Move SBOM generation after release creation in release workflow (#10501)
• 12346cc Upload compiled Linux binary as CI artifact (#10498)
• 91fefe2 Remove included_file_schema.json and consolidate to single main workflow sche...
• b5cf079 Consolidate release artifacts, simplify release_tag usage, fix release creati...
• 085e057 Fix daily firewall report caching stale aggregated data (#10492)
• 6633b6f Add daily regulatory agentic workflow for monitoring daily reports (#10491)
• aa36291 Add daily observability report workflow for AWF firewall and MCP Gateway logg...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	77.88%	77.88%	➡️ +0.00%
Statements	77.94%	77.94%	➡️ +0.00%
Functions	77.29%	77.29%	➡️ +0.00%
Branches	71.00%	71.00%	➡️ +0.00%

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[github-actions]

📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident...

[github-actions]

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

[Mossaka]

Closing PR to reduce backlog. This is a routine dependency update that can be regenerated by Dependabot when needed.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.