[Deps] Safe dependency updates (2026-08-22)

Automated Safe Dependency Updates

This PR contains safe patch-level dependency updates verified to pass the test suite and build.

Updated Dependencies

Package	Previous	Updated	Type
eslint	^10.8.0	^10.9.0	patch

Security Fixes Included

None — npm audit reported 0 vulnerabilities and no open Dependabot alerts were accessible/found. This is a routine patch-level freshness update.

Verification

npm run build passes
npm test passes (308/311 suites; the 3 pre-existing failures in src/enclave/mount-policy.test.ts and related files reproduce identically on main without this change — they stem from /var/tmp not existing in this sandbox environment, unrelated to the dependency update)

Notes

Other outdated packages (@babel/core, commander, execa, typescript, chalk, @commitlint/*, eslint-plugin-security, @types/node, @types/glob) all require major version bumps and were intentionally excluded from this "safe updates" PR to avoid breaking changes. No HIGH/CRITICAL vulnerabilities were found via npm audit; Dependabot alerts could not be queried due to insufficient token scope (security_events) — recommend checking the Security tab manually if automated access is restored.

Generated by Dependency Security Monitor Workflow

Warning

Protected Files — Push Permission Denied

This was originally intended as a pull request, but the patch modifies protected files. A human must create the pull request manually.

Protected files

package-lock.json

package.json

The push was rejected because GitHub Actions does not have workflows permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission.

Create the pull request manually

# Download the patch from the workflow run
gh run download 32555673466 -n agent -D /tmp/agent-32555673466

# Create a new branch
git checkout -b deps/safe-updates-20260822-b59b46aba42ddbb5 main

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-32555673466/aw-deps-safe-updates-20260822.patch

# Push the branch and create the pull request
git push origin deps/safe-updates-20260822-b59b46aba42ddbb5
gh pr create --title '[Deps] Safe dependency updates (2026-08-22)' --base main --head deps/safe-updates-20260822-b59b46aba42ddbb5 --repo github/gh-aw-firewall

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

msfeed2.pkgs.visualstudio.com
msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed2.pkgs.visualstudio.com"
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

Generated by Dependency Security Monitor · auto · 33.1 AIC · ⊞ 13.2K · ◷