From 9ba74a660a177dc06addace6b3ae220d03867917 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 25 Aug 2026 14:04:34 +0000
Subject: [PATCH 01/10] Enforce secure gh-aw compatibility floor

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/aw/compat.json                        |  2 +-
 .../SKILL.md                                  | 80 +++++++++++++++++++
 2 files changed, 81 insertions(+), 1 deletion(-)
 create mode 100644 .github/skills/security-advisory-compat-enforcer/SKILL.md

diff --git a/.github/aw/compat.json b/.github/aw/compat.json
index d3013734d47..dd840f00e9f 100644
--- a/.github/aw/compat.json
+++ b/.github/aw/compat.json
@@ -1,7 +1,7 @@
 {
   "$schema": "./compat.schema.json",
   "blockedVersions": [],
-  "minimumVersion": "v0.65.3",
+  "minimumVersion": "v0.85.3",
   "minRecommendedVersion": "v0.65.3",
   "agent-compat-v1": {
     "cache-ttl-days": 14,
diff --git a/.github/skills/security-advisory-compat-enforcer/SKILL.md b/.github/skills/security-advisory-compat-enforcer/SKILL.md
new file mode 100644
index 00000000000..12143183189
--- /dev/null
+++ b/.github/skills/security-advisory-compat-enforcer/SKILL.md
@@ -0,0 +1,80 @@
+---
+name: security-advisory-compat-enforcer
+description: Review a GitHub security advisory and safely update .github/aw/compat.json with evidence-backed version enforcement.
+---
+
+# Security Advisory Compatibility Enforcer
+
+Use this skill to translate a GitHub repository security advisory into the
+smallest safe update to `.github/aw/compat.json`.
+
+## Required inputs
+
+Record the repository, GHSA identifier, requested enforcement policy, and any
+patched version supplied by the user. Treat a user-supplied version as a target
+to verify, not as evidence for advisory details.
+
+## Evidence retrieval
+
+1. Attempt authenticated retrieval first:
+   `gh api repos/OWNER/REPO/security-advisories/GHSA-ID`.
+2. If authentication is unavailable or access fails, try the public global
+   advisory endpoint: `gh api advisories/GHSA-ID` (or its equivalent REST URL).
+3. Record the endpoint and outcome of each attempt. If both sources are
+   inaccessible, state that explicitly. Never infer or invent the affected
+   package, vulnerable range, severity, CVE, publication state, or patched
+   version.
+4. Verify the proposed patched version independently. Prefer a published
+   repository release or tag, then package-registry metadata when applicable.
+   Cite the exact URL or command result. Do not update compatibility policy if
+   the target cannot be verified, unless the user explicitly directs use of a
+   supplied target despite inaccessible advisory metadata; document that
+   limitation without converting it into fabricated advisory evidence.
+
+## Choose the correct policy field
+
+- `minimumVersion` is a hard floor: activation fails for every compiler version
+  below it. Change it only when the requested remediation is a universal
+  minimum-version enforcement.
+- `blockedVersions` rejects listed versions exactly. Change it only when
+  evidence or explicit instructions identify exact versions to deny and a
+  continuous minimum floor would be inaccurate.
+- `minRecommendedVersion` only warns below the value. Change it only for an
+  explicitly requested recommendation, never as a substitute for enforcement.
+- Agent rows under `agent-compat-v1` select compatible agent versions; they are
+  unrelated to compiler security enforcement unless separate evidence requires
+  an agent compatibility change.
+
+## Safe edit procedure
+
+1. Parse the current JSON and record all four policy areas above.
+2. Compare semantic versions numerically. A minimum is monotonic: never lower a
+   non-empty `minimumVersion` or `minRecommendedVersion`. Stop and report a
+   requested downgrade rather than applying it.
+3. Make the narrowest evidence-backed edit. Preserve `blockedVersions`,
+   `minRecommendedVersion`, every `agent-compat-v1` row, key ordering, and
+   formatting unless the selected policy specifically requires changing them.
+4. Review the final diff and reject unrelated changes.
+
+## Required validation
+
+Before reporting completion:
+
+1. Parse `.github/aw/compat.json` as JSON.
+2. Validate it against `.github/aw/compat.schema.json` using the repository's
+   schema validator.
+3. Exercise the runtime policy semantics with versions immediately below, at,
+   and above the changed boundary; confirm only the intended hard-fail, warning,
+   or exact-block behavior changed.
+4. Confirm semantic-version monotonicity and byte-for-byte preservation of
+   unrelated policy fields and agent rows.
+
+Do not claim validation that was not run. If repository constraints prohibit a
+required check, report it as outstanding.
+
+## Report
+
+Cite advisory retrieval attempts and patched-version verification. State which
+field changed, old and new values, why that policy is correct, which fields were
+preserved, and the schema/runtime validation results. Clearly separate verified
+facts, user-provided inputs, and unavailable advisory details.

From 313ee1e1ab61d53236cb6f433aa050aac53b05d6 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:20:46 +0000
Subject: [PATCH 02/10] Ban advisory-affected gh-aw releases

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/aw/compat.json | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/.github/aw/compat.json b/.github/aw/compat.json
index dd840f00e9f..c383e6b0cd5 100644
--- a/.github/aw/compat.json
+++ b/.github/aw/compat.json
@@ -1,7 +1,30 @@
 {
   "$schema": "./compat.schema.json",
-  "blockedVersions": [],
-  "minimumVersion": "v0.85.3",
+  "blockedVersions": [
+    "v0.82.8",
+    "v0.82.9",
+    "v0.82.10",
+    "v0.82.11",
+    "v0.82.12",
+    "v0.82.13",
+    "v0.82.14",
+    "v0.82.15",
+    "v0.83.0",
+    "v0.83.1",
+    "v0.83.2",
+    "v0.83.3",
+    "v0.83.4",
+    "v0.83.5",
+    "v0.84.0",
+    "v0.84.1",
+    "v0.84.2",
+    "v0.84.3",
+    "v0.84.4",
+    "v0.85.0",
+    "v0.85.1",
+    "v0.85.2"
+  ],
+  "minimumVersion": "v0.65.3",
   "minRecommendedVersion": "v0.65.3",
   "agent-compat-v1": {
     "cache-ttl-days": 14,

From b435280bf27cde824034990163becc274ecf2195 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:49:54 +0000
Subject: [PATCH 03/10] Correct advisory release boundary

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/aw/compat.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/aw/compat.json b/.github/aw/compat.json
index c383e6b0cd5..258ca10c8ce 100644
--- a/.github/aw/compat.json
+++ b/.github/aw/compat.json
@@ -22,7 +22,8 @@
     "v0.84.4",
     "v0.85.0",
     "v0.85.1",
-    "v0.85.2"
+    "v0.85.2",
+    "v0.85.3"
   ],
   "minimumVersion": "v0.65.3",
   "minRecommendedVersion": "v0.65.3",

From b3644de78a4113ad98107eb2fa067c09d446f569 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 25 Aug 2026 18:04:50 +0000
Subject: [PATCH 04/10] Document blocked compatibility versions

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/aw/compat.md                          |  8 +++++++
 .../SKILL.md                                  | 24 ++++++++++++-------
 2 files changed, 24 insertions(+), 8 deletions(-)
 create mode 100644 .github/aw/compat.md

diff --git a/.github/aw/compat.md b/.github/aw/compat.md
new file mode 100644
index 00000000000..1cd8376b692
--- /dev/null
+++ b/.github/aw/compat.md
@@ -0,0 +1,8 @@
+# Blocked gh-aw versions
+
+The following releases are blocked by `.github/aw/compat.json` and fail during
+workflow activation.
+
+| Versions | Reason |
+| --- | --- |
+| `v0.82.8` through `v0.85.3` | Affected by [GHSA-8h78-hpm7-29gg](https://github.com/github/gh-aw/security/advisories/GHSA-8h78-hpm7-29gg). `v0.85.4` is the first unaffected release. |
diff --git a/.github/skills/security-advisory-compat-enforcer/SKILL.md b/.github/skills/security-advisory-compat-enforcer/SKILL.md
index 12143183189..374020786b6 100644
--- a/.github/skills/security-advisory-compat-enforcer/SKILL.md
+++ b/.github/skills/security-advisory-compat-enforcer/SKILL.md
@@ -54,19 +54,26 @@ to verify, not as evidence for advisory details.
 3. Make the narrowest evidence-backed edit. Preserve `blockedVersions`,
    `minRecommendedVersion`, every `agent-compat-v1` row, key ordering, and
    formatting unless the selected policy specifically requires changing them.
-4. Review the final diff and reject unrelated changes.
+4. When changing `blockedVersions`, update `.github/aw/compat.md` in the same
+   change. Account for every blocked version, state why each version or
+   contiguous range is blocked, and link to the corresponding advisory.
+5. Review the final diff and reject unrelated changes.
 
 ## Required validation
 
 Before reporting completion:
 
-1. Parse `.github/aw/compat.json` as JSON.
-2. Validate it against `.github/aw/compat.schema.json` using the repository's
-   schema validator.
-3. Exercise the runtime policy semantics with versions immediately below, at,
+1. Run the repository's `Validate compat.json structure and version formats`
+   task from `.github/workflows/cgo.yml`.
+2. Validate `.github/aw/compat.json` against
+   `.github/aw/compat.schema.json` with a JSON Schema Draft 7 validator. JSON
+   parsing or ad hoc field checks are not substitutes for schema validation.
+3. Confirm `.github/aw/compat.md` accounts for every `blockedVersions` entry
+   and that each documented range links to its advisory.
+4. Exercise the runtime policy semantics with versions immediately below, at,
    and above the changed boundary; confirm only the intended hard-fail, warning,
    or exact-block behavior changed.
-4. Confirm semantic-version monotonicity and byte-for-byte preservation of
+5. Confirm semantic-version monotonicity and byte-for-byte preservation of
    unrelated policy fields and agent rows.
 
 Do not claim validation that was not run. If repository constraints prohibit a
@@ -76,5 +83,6 @@ required check, report it as outstanding.
 
 Cite advisory retrieval attempts and patched-version verification. State which
 field changed, old and new values, why that policy is correct, which fields were
-preserved, and the schema/runtime validation results. Clearly separate verified
-facts, user-provided inputs, and unavailable advisory details.
+preserved, and the compatibility task, schema, documentation, and runtime
+validation results. Clearly separate verified facts, user-provided inputs, and
+unavailable advisory details.

From e5e0922c29988969a48f315d0d2b568e97221d45 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 25 Aug 2026 20:22:08 +0000
Subject: [PATCH 05/10] Test compat configuration schema validation

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 pkg/linters/compat_schema_test.go | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 pkg/linters/compat_schema_test.go

diff --git a/pkg/linters/compat_schema_test.go b/pkg/linters/compat_schema_test.go
new file mode 100644
index 00000000000..fec3742e1a3
--- /dev/null
+++ b/pkg/linters/compat_schema_test.go
@@ -0,0 +1,27 @@
+//go:build !integration
+
+package linters_test
+
+import (
+	"encoding/json"
+	"os"
+	"testing"
+
+	"github.com/github/gh-aw/pkg/parser"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCompatJSONConformsToSchema(t *testing.T) {
+	schemaJSON, err := os.ReadFile("../../.github/aw/compat.schema.json")
+	require.NoError(t, err)
+
+	schema, err := parser.CompileSchema(string(schemaJSON), "https://github.com/github/gh-aw/.github/aw/compat.schema.json")
+	require.NoError(t, err)
+
+	configJSON, err := os.ReadFile("../../.github/aw/compat.json")
+	require.NoError(t, err)
+
+	var config any
+	require.NoError(t, json.Unmarshal(configJSON, &config))
+	require.NoError(t, schema.Validate(config))
+}

From 10333414304a7f76c0c12e7c0645869fdb6aecc5 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 25 Aug 2026 20:32:59 +0000
Subject: [PATCH 06/10] Add advisory remediation guidance

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/aw/compat.md                          | 19 ++++++++++
 .../SKILL.md                                  | 35 +++++++++++++++++--
 2 files changed, 51 insertions(+), 3 deletions(-)

diff --git a/.github/aw/compat.md b/.github/aw/compat.md
index 1cd8376b692..6fd1b559653 100644
--- a/.github/aw/compat.md
+++ b/.github/aw/compat.md
@@ -6,3 +6,22 @@ workflow activation.
 | Versions | Reason |
 | --- | --- |
 | `v0.82.8` through `v0.85.3` | Affected by [GHSA-8h78-hpm7-29gg](https://github.com/github/gh-aw/security/advisories/GHSA-8h78-hpm7-29gg). `v0.85.4` is the first unaffected release. |
+
+## Remediation
+
+Upgrade to [`v0.85.4`](https://github.com/github/gh-aw/releases/tag/v0.85.4) or
+later, verify the installed version, then regenerate and review the repository's
+compiled workflows:
+
+```bash
+gh extension upgrade gh-aw
+gh aw version
+gh aw upgrade
+git diff -- .github/workflows
+```
+
+Confirm that `gh aw version` reports `v0.85.4` or later and commit the regenerated
+`.lock.yml` files. Blocking the affected compiler versions prevents their
+workflows from activating but does not regenerate existing workflow artifacts.
+See [Upgrading Agentic Workflows](https://github.com/github/gh-aw/blob/main/docs/src/content/docs/guides/upgrading.md)
+for the supported upgrade process.
diff --git a/.github/skills/security-advisory-compat-enforcer/SKILL.md b/.github/skills/security-advisory-compat-enforcer/SKILL.md
index 374020786b6..b9b04515d19 100644
--- a/.github/skills/security-advisory-compat-enforcer/SKILL.md
+++ b/.github/skills/security-advisory-compat-enforcer/SKILL.md
@@ -45,6 +45,33 @@ to verify, not as evidence for advisory details.
   unrelated to compiler security enforcement unless separate evidence requires
   an agent compatibility change.
 
+## Write remediation guidance
+
+Provide concise, actionable remediation in `.github/aw/compat.md` and the final
+report. Follow established security-advisory terminology:
+
+1. Identify the affected product or component, GHSA identifier, CVE identifier
+   when assigned, affected versions, and first fixed or unaffected version.
+   Use exact bounded ranges and do not broaden the advisory's claims.
+2. State the permanent remediation in imperative language. Give exact,
+   copyable upgrade and regeneration commands verified against official
+   documentation. For compiler advisories, explain whether existing generated
+   workflows must be recompiled and redeployed; blocking a vulnerable version
+   prevents execution but does not repair generated artifacts.
+3. Separate remediation from mitigations and workarounds. Include a temporary
+   measure only when the advisory documents it. If the retrieved advisory does
+   not identify one, say so without claiming that no workaround exists.
+4. Include a verification step that checks the installed version and any
+   regenerated artifacts. Do not treat a successful install alone as proof that
+   deployed workflows were remediated.
+5. Link the advisory, fixed release, and authoritative upgrade documentation.
+   Mention severity, CVSS, known exploitation, CISA KEV status, deadlines, or
+   urgency only when verified from authoritative evidence.
+
+Do not invent commands, CVE identifiers, affected configurations, mitigations,
+or timelines. If remediation details cannot be verified, identify the missing
+evidence and leave the instructions explicitly incomplete.
+
 ## Safe edit procedure
 
 1. Parse the current JSON and record all four policy areas above.
@@ -56,7 +83,8 @@ to verify, not as evidence for advisory details.
    formatting unless the selected policy specifically requires changing them.
 4. When changing `blockedVersions`, update `.github/aw/compat.md` in the same
    change. Account for every blocked version, state why each version or
-   contiguous range is blocked, and link to the corresponding advisory.
+   contiguous range is blocked, link to the corresponding advisory, and provide
+   the remediation and verification steps defined above.
 5. Review the final diff and reject unrelated changes.
 
 ## Required validation
@@ -84,5 +112,6 @@ required check, report it as outstanding.
 Cite advisory retrieval attempts and patched-version verification. State which
 field changed, old and new values, why that policy is correct, which fields were
 preserved, and the compatibility task, schema, documentation, and runtime
-validation results. Clearly separate verified facts, user-provided inputs, and
-unavailable advisory details.
+validation results. Include the remediation, any advisory-supported temporary
+mitigation, and verification steps. Clearly separate verified facts,
+user-provided inputs, and unavailable advisory details.

From 84c209e7c5df970309756c14e01b62737dfc295b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 26 Aug 2026 14:20:31 +0000
Subject: [PATCH 07/10] Regenerate agentic workflows skill index

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/skills/agentic-workflows/SKILL.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/skills/agentic-workflows/SKILL.md b/.github/skills/agentic-workflows/SKILL.md
index e9fb5f1ec3a..eeb13ec2f2e 100644
--- a/.github/skills/agentic-workflows/SKILL.md
+++ b/.github/skills/agentic-workflows/SKILL.md
@@ -24,6 +24,7 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/charts-trending.md`
 - `.github/aw/charts.md`
 - `.github/aw/cli-commands.md`
+- `.github/aw/compat.md`
 - `.github/aw/configure-agentic-engine.md`
 - `.github/aw/context.md`
 - `.github/aw/create-agentic-workflow-trigger-details.md`

From 3b028528c404740c69ae43cd68c09f0c1c770d65 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 26 Aug 2026 18:22:07 +0000
Subject: [PATCH 08/10] Fix fallback AW files list to include compat.md

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 pkg/cli/data/agentic_workflows_fallback_aw_files.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkg/cli/data/agentic_workflows_fallback_aw_files.json b/pkg/cli/data/agentic_workflows_fallback_aw_files.json
index 72e31a1a7c8..d91ebc97e38 100644
--- a/pkg/cli/data/agentic_workflows_fallback_aw_files.json
+++ b/pkg/cli/data/agentic_workflows_fallback_aw_files.json
@@ -8,6 +8,7 @@
   "charts-trending.md",
   "charts.md",
   "cli-commands.md",
+  "compat.md",
   "configure-agentic-engine.md",
   "context.md",
   "create-agentic-workflow-trigger-details.md",

From b2d52b032e46068619261ea5b26434d5c88fd2bb Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 26 Aug 2026 18:25:54 +0000
Subject: [PATCH 09/10] Address review feedback: fix broken remediation link,
 bump minRecommendedVersion, add boundary test

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/aw/compat.json            |  2 +-
 .github/aw/compat.md              |  2 +-
 pkg/linters/compat_schema_test.go | 19 +++++++++++++++++++
 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/.github/aw/compat.json b/.github/aw/compat.json
index 258ca10c8ce..185e1335401 100644
--- a/.github/aw/compat.json
+++ b/.github/aw/compat.json
@@ -26,7 +26,7 @@
     "v0.85.3"
   ],
   "minimumVersion": "v0.65.3",
-  "minRecommendedVersion": "v0.65.3",
+  "minRecommendedVersion": "v0.85.4",
   "agent-compat-v1": {
     "cache-ttl-days": 14,
     "copilot": [
diff --git a/.github/aw/compat.md b/.github/aw/compat.md
index 6fd1b559653..a97f7903d1a 100644
--- a/.github/aw/compat.md
+++ b/.github/aw/compat.md
@@ -23,5 +23,5 @@ git diff -- .github/workflows
 Confirm that `gh aw version` reports `v0.85.4` or later and commit the regenerated
 `.lock.yml` files. Blocking the affected compiler versions prevents their
 workflows from activating but does not regenerate existing workflow artifacts.
-See [Upgrading Agentic Workflows](https://github.com/github/gh-aw/blob/main/docs/src/content/docs/guides/upgrading.md)
+See [Upgrading Workflows](https://github.com/github/gh-aw/blob/main/docs/src/content/docs/guides/working-with-workflows.mdx#upgrading-workflows)
 for the supported upgrade process.
diff --git a/pkg/linters/compat_schema_test.go b/pkg/linters/compat_schema_test.go
index fec3742e1a3..54f64d9bcf2 100644
--- a/pkg/linters/compat_schema_test.go
+++ b/pkg/linters/compat_schema_test.go
@@ -25,3 +25,22 @@ func TestCompatJSONConformsToSchema(t *testing.T) {
 	require.NoError(t, json.Unmarshal(configJSON, &config))
 	require.NoError(t, schema.Validate(config))
 }
+
+// TestCompatBlockedVersionsBoundary locks in the boundaries of the
+// GHSA-8h78-hpm7-29gg blocked range so that an accidental edit to
+// .github/aw/compat.json is caught by CI instead of silently reintroducing
+// an affected version or over-blocking a safe one.
+func TestCompatBlockedVersionsBoundary(t *testing.T) {
+	configJSON, err := os.ReadFile("../../.github/aw/compat.json")
+	require.NoError(t, err)
+
+	var config struct {
+		BlockedVersions []string `json:"blockedVersions"`
+	}
+	require.NoError(t, json.Unmarshal(configJSON, &config))
+
+	require.Contains(t, config.BlockedVersions, "v0.82.8", "first affected version must be blocked")
+	require.Contains(t, config.BlockedVersions, "v0.85.3", "last affected version must be blocked")
+	require.NotContains(t, config.BlockedVersions, "v0.82.7", "version before the affected range must not be blocked")
+	require.NotContains(t, config.BlockedVersions, "v0.85.4", "first fixed version must not be blocked")
+}

From 2e2ca3411554d1fb2d8c5191bbbd354aebd2d28f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 27 Aug 2026 20:27:54 +0000
Subject: [PATCH 10/10] Revert compat.json and compat.md changes per maintainer
 request

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/aw/compat.json                        | 28 ++-----------------
 .github/aw/compat.md                          | 27 ------------------
 .github/skills/agentic-workflows/SKILL.md     |  1 -
 .../agentic_workflows_fallback_aw_files.json  |  1 -
 pkg/linters/compat_schema_test.go             | 19 -------------
 5 files changed, 2 insertions(+), 74 deletions(-)
 delete mode 100644 .github/aw/compat.md

diff --git a/.github/aw/compat.json b/.github/aw/compat.json
index 185e1335401..d3013734d47 100644
--- a/.github/aw/compat.json
+++ b/.github/aw/compat.json
@@ -1,32 +1,8 @@
 {
   "$schema": "./compat.schema.json",
-  "blockedVersions": [
-    "v0.82.8",
-    "v0.82.9",
-    "v0.82.10",
-    "v0.82.11",
-    "v0.82.12",
-    "v0.82.13",
-    "v0.82.14",
-    "v0.82.15",
-    "v0.83.0",
-    "v0.83.1",
-    "v0.83.2",
-    "v0.83.3",
-    "v0.83.4",
-    "v0.83.5",
-    "v0.84.0",
-    "v0.84.1",
-    "v0.84.2",
-    "v0.84.3",
-    "v0.84.4",
-    "v0.85.0",
-    "v0.85.1",
-    "v0.85.2",
-    "v0.85.3"
-  ],
+  "blockedVersions": [],
   "minimumVersion": "v0.65.3",
-  "minRecommendedVersion": "v0.85.4",
+  "minRecommendedVersion": "v0.65.3",
   "agent-compat-v1": {
     "cache-ttl-days": 14,
     "copilot": [
diff --git a/.github/aw/compat.md b/.github/aw/compat.md
deleted file mode 100644
index a97f7903d1a..00000000000
--- a/.github/aw/compat.md
+++ /dev/null
@@ -1,27 +0,0 @@
-# Blocked gh-aw versions
-
-The following releases are blocked by `.github/aw/compat.json` and fail during
-workflow activation.
-
-| Versions | Reason |
-| --- | --- |
-| `v0.82.8` through `v0.85.3` | Affected by [GHSA-8h78-hpm7-29gg](https://github.com/github/gh-aw/security/advisories/GHSA-8h78-hpm7-29gg). `v0.85.4` is the first unaffected release. |
-
-## Remediation
-
-Upgrade to [`v0.85.4`](https://github.com/github/gh-aw/releases/tag/v0.85.4) or
-later, verify the installed version, then regenerate and review the repository's
-compiled workflows:
-
-```bash
-gh extension upgrade gh-aw
-gh aw version
-gh aw upgrade
-git diff -- .github/workflows
-```
-
-Confirm that `gh aw version` reports `v0.85.4` or later and commit the regenerated
-`.lock.yml` files. Blocking the affected compiler versions prevents their
-workflows from activating but does not regenerate existing workflow artifacts.
-See [Upgrading Workflows](https://github.com/github/gh-aw/blob/main/docs/src/content/docs/guides/working-with-workflows.mdx#upgrading-workflows)
-for the supported upgrade process.
diff --git a/.github/skills/agentic-workflows/SKILL.md b/.github/skills/agentic-workflows/SKILL.md
index eeb13ec2f2e..e9fb5f1ec3a 100644
--- a/.github/skills/agentic-workflows/SKILL.md
+++ b/.github/skills/agentic-workflows/SKILL.md
@@ -24,7 +24,6 @@ Load these files from `github/gh-aw` (they are not available locally).
 - `.github/aw/charts-trending.md`
 - `.github/aw/charts.md`
 - `.github/aw/cli-commands.md`
-- `.github/aw/compat.md`
 - `.github/aw/configure-agentic-engine.md`
 - `.github/aw/context.md`
 - `.github/aw/create-agentic-workflow-trigger-details.md`
diff --git a/pkg/cli/data/agentic_workflows_fallback_aw_files.json b/pkg/cli/data/agentic_workflows_fallback_aw_files.json
index d91ebc97e38..72e31a1a7c8 100644
--- a/pkg/cli/data/agentic_workflows_fallback_aw_files.json
+++ b/pkg/cli/data/agentic_workflows_fallback_aw_files.json
@@ -8,7 +8,6 @@
   "charts-trending.md",
   "charts.md",
   "cli-commands.md",
-  "compat.md",
   "configure-agentic-engine.md",
   "context.md",
   "create-agentic-workflow-trigger-details.md",
diff --git a/pkg/linters/compat_schema_test.go b/pkg/linters/compat_schema_test.go
index 54f64d9bcf2..fec3742e1a3 100644
--- a/pkg/linters/compat_schema_test.go
+++ b/pkg/linters/compat_schema_test.go
@@ -25,22 +25,3 @@ func TestCompatJSONConformsToSchema(t *testing.T) {
 	require.NoError(t, json.Unmarshal(configJSON, &config))
 	require.NoError(t, schema.Validate(config))
 }
-
-// TestCompatBlockedVersionsBoundary locks in the boundaries of the
-// GHSA-8h78-hpm7-29gg blocked range so that an accidental edit to
-// .github/aw/compat.json is caught by CI instead of silently reintroducing
-// an affected version or over-blocking a safe one.
-func TestCompatBlockedVersionsBoundary(t *testing.T) {
-	configJSON, err := os.ReadFile("../../.github/aw/compat.json")
-	require.NoError(t, err)
-
-	var config struct {
-		BlockedVersions []string `json:"blockedVersions"`
-	}
-	require.NoError(t, json.Unmarshal(configJSON, &config))
-
-	require.Contains(t, config.BlockedVersions, "v0.82.8", "first affected version must be blocked")
-	require.Contains(t, config.BlockedVersions, "v0.85.3", "last affected version must be blocked")
-	require.NotContains(t, config.BlockedVersions, "v0.82.7", "version before the affected range must not be blocked")
-	require.NotContains(t, config.BlockedVersions, "v0.85.4", "first fixed version must not be blocked")
-}