[aaronpowell]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services. N/A: dependency update.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory. N/A: dependency update.
• The file follows the required naming convention. N/A: no new resource files.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot. N/A: dependency update.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Update the pinned @microsoft/vally dependency from 0.18.0 to 0.20.0 so external plugin quality gates use the newer validator before we send remediation feedback upstream. Regenerate the lockfile, including Vally's transitive dependency updates, using public npm registry URLs.

Rerunning lint with 0.20.0 against the nine original plugin SHAs from #5260 produced identical failure diagnostics: five plugins and 46 skills still fail. No external plugin metadata or upstream skill content changes are included.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify): Vally development dependency and lockfile update.

---

Additional Notes

Validation:

• node --test eng/external-plugin-quality-gates.test.mjs: passed, 14 tests.
• npm start: passed; generated README and marketplace outputs remain unchanged. Existing license warnings remain.
• bash eng/fix-line-endings.sh: passed.
• git diff --check: passed.
• Local Vally 0.20.0 API rerun at all nine original pinned source SHAs: completed; failure diagnostics identical to the original CI artifact. Azure, dotnet, dotnet-diag, and dotnet-test pass; dataverse, git-ape, microsoft-events, skills-for-copilot-studio, and whatidid retain their reported failures.

Install smoke tests and version-match gates were not rerun. The remediation report and reproduction artifacts remain session-only and are not committed.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🚦 Submission status: 👀 Ready for review

Risk tier: merge-risk:high — Privileged execution, automation, or review-policy change
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access, including a maintainer with admin or maintain permission.

Why this tier

• package-lock.json is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• package.json is a high-risk path (automation, scripts, MCP config, hooks, or review policy)

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	✅ Passed	Passed · logs

Review

• Approvals: 0/1
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s); an approval from a maintainer with admin or maintain permission
• The core-maintainers pool is not staffed yet; an approver with admin or maintain permission is required instead.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for 79d357a · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[Copilot]

🟡 Changes recommended

The regenerated lockfile replaces existing SHA-512 integrity pins with weaker SHA-1 hashes.

No open issues 🎉

What changed in this PR

Updates Vally for external-plugin quality gates before sending upstream remediation feedback for the plugins covered by #5260.

Changes:

• Upgrades the pinned @microsoft/vally dependency from 0.18.0 to 0.20.0.
• Regenerates transitive dependencies using public npm registry URLs, without changing external-plugin metadata or content.

File	Description
package.json	Pins Vally to 0.20.0.
package-lock.json	Records the updated validator and transitive dependency graph.

_{Review effort: Max}