[Deps] Safe dependency updates (2026-07-31)

Automated Safe Dependency Updates

This PR contains safe patch-level dependency updates that have been verified to pass all tests (no new failures introduced) and have no breaking changes.

Updated Dependencies

Package	Previous	Updated	Type
globals	17.7.0	17.8.0	patch
markdownlint-cli2	0.23.1	0.23.2	patch

Security Fixes Included

None — npm audit reported 0 vulnerabilities (0 critical/high/moderate/low) across all 651 dependencies at the time of this run. GitHub Dependabot alerts could not be checked in this run because the workflow token lacks security_events/Dependabot-alerts read permission for this repository (403 response) — please verify no such alerts exist separately or grant that permission to this workflow.

Verification

npm audit --json → 0 vulnerabilities
npm test run before and after the update: 42 pre-existing test failures (in src/bounded-query/*.test.ts, caused by /var/tmp permission/EACCES issues in this sandbox environment, unrelated to dependency versions) are present identically on main and on this branch — no new failures were introduced by these updates
Docker build verification not performed in this run (no Docker-in-Docker support in this environment)

Notes

Other outdated packages (@babel/core, commander, execa, chalk, typescript, etc.) have available major version bumps only, which are excluded per the "safe update" policy (patch-only, direct dependencies).
@types/node and @types/glob were left unchanged (current/wanted match; latest for @types/glob is actually older than current, likely a typing mismatch — skipped out of caution).

Generated by Dependency Security Monitor Workflow

Warning

Protected Files — Push Permission Denied

This was originally intended as a pull request, but the patch modifies protected files. A human must create the pull request manually.

Protected files

package-lock.json

package.json

The push was rejected because GitHub Actions does not have workflows permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission.

Create the pull request manually

# Download the patch from the workflow run
gh run download 30602421188 -n agent -D /tmp/agent-30602421188

# Create a new branch
git checkout -b safe-deps-update-20260731-eb4a9d32b4f19019 main

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-30602421188/aw-safe-deps-update-20260731.patch

# Push the branch and create the pull request
git push origin safe-deps-update-20260731-eb4a9d32b4f19019
gh pr create --title '[Deps] Safe dependency updates (2026-07-31)' --base main --head safe-deps-update-20260731-eb4a9d32b4f19019 --repo github/gh-aw-firewall

Generated by Dependency Security Monitor · aut00 · 30.9 AIC · ⊞ 12.5K · ◷