build(deps): update dfx-agentguard requirement from >=0.2.0 to >=0.8.3

[dependabot]

Updates the requirements on dfx-agentguard to permit the latest version.

Changelog

Sourced from dfx-agentguard's changelog.

[0.8.3] - 2026-07-16

Fixed

• Self-scan false positive reduction (87%): 249 → 32 findings when scanning AgentGuard's own codebase
• ASI10 Trust Boundary: 200+ → 5 findings — added REGEX_PATTERN_LINE exclusion for security detector patterns
• ASI06 Unsafe Eval: 20 → 12 findings — added REGEX_DETECTOR_LINE to skip r'...eval/exec/...' detector strings
• 7 exclusion patterns added for ASI10 in false_positive_filter.py
• 3 exclusion patterns added for ASI06 in false_positive_filter.py
• Precommit tests now skip cleanly when pre-commit binary is not installed (3 skipped, 0 failed)

[0.8.2] - 2026-07-15

Fixed

• GHSA-44f8: ShellToolMiddleware CVSS 10.0 disclosure analysis + LGPL v3 classifier

[0.8.1] - 2026-07-12

Fixed

• All 6 remaining false positives fixed (single pattern: def _update_prompts flagged as ASI10 self-modification)
• CLI version now reads from __version__ instead of hardcoded string

Changed

• License: MIT → LGPL v3 (protects core from cloud vendor appropriation; apps/extensions remain MIT-compatible)
• README precision claim: "scheduled for fix" → confirmed fixed; added license row to precision table

[0.8.0] - 2026-07-08

Added

• Automatic False Positive Filtering (false_positive_filter.py): Post-scan FP detection using:
  • Rule-specific exclusion patterns (known FP regexes per rule)
  • File-level heuristics (metadata files, lock files, configs)
  • Content-level heuristics (comments, documentation, security docs)
  • Density-based anomaly detection (single rule flooding >50 findings/file)
  • Severity auto-downgrade for noisy rule patterns
• Automatic Finding Classification (classifier.py): 4-tier classification:
  • CONFIRMED: High-confidence actionable vulnerabilities
  • INVESTIGATE: Needs human review
  • BEST_PRACTICE: Security pattern, not exploitable
  • LIKELY_FP: Probable false positive
• Auto Report Generation (auto_reporter.py):
  • Structured Markdown audit reports with executive summary, OWASP coverage, top findings
  • JSON summary for programmatic consumption
  • CI-mode concise one-liner (--ci flag)
  • Risk scoring (weighted by severity)
  • Framework health assessment (HEALTHY / NEEDS REVIEW / CRITICAL)
• New CLI flags: --no-fp-filter, --no-classify, --auto-report PATH, --ci
• Scanner now skips lock files (package-lock.json, yarn.lock, poetry.lock, etc.)

Changed

• scan_directory() now accepts enable_fp_filter and enable_classifier flags

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)