[Deps] Safe dependency updates (2026-05-22)

[github-actions]

Automated Safe Dependency Updates

This PR contains safe dependency updates within existing semver ranges that have been verified to:

• ✅ Pass all tests
• ✅ Have no breaking changes
• ✅ Address known security vulnerabilities

Updated Dependencies

All packages updated to their wanted versions (within declared semver ranges in package.json). Notable updates include:

Package	Previous	Updated	Type
@babel/preset-env	7.29.2	7.29.5	patch
@commitlint/cli	20.5.0	20.5.3	patch
@commitlint/config-conventional	20.5.0	20.5.3	patch
@eslint/compat	2.0.5	2.1.0	minor
@types/node	25.6.0	25.9.1	minor
@typescript-eslint/eslint-plugin	8.58.2	8.59.4	patch
@typescript-eslint/parser	8.58.2	8.59.4	patch
ajv	8.18.0	8.20.0	minor
babel-jest	30.3.0	30.4.1	minor
eslint	10.2.1	10.4.0	minor
globals	17.5.0	17.6.0	minor
jest	30.3.0	30.4.2	minor
ts-jest	29.4.9	29.4.11	patch
typescript-eslint	8.58.2	8.59.4	patch

Security Fixes Included

• GHSA-jxxr-4gwj-5jf2 (MODERATE): brace-expansion 5.0.5 → 5.0.6 — Large numeric range defeats documented max DoS protection (CVSS 6.5). Resolved as a transitive dependency update.

Verification

• All tests pass (2018/2020 — 2 pre-existing failures unrelated to these changes: DNS resolution env issue + /var/tmp permission issue)
• No breaking changes detected (only package-lock.json modified)
• npm audit reports 0 vulnerabilities after update

Notes

Only package-lock.json was modified. package.json version ranges are unchanged. The remaining outdated packages (chalk, commander, execa, typescript, etc.) have major version bumps that may include breaking changes and are excluded from this automated update.

---

Generated by Dependency Security Monitor Workflow

---

Warning

Protected Files — Push Permission Denied

This was originally intended as a pull request, but the patch modifies protected files. A human must create the pull request manually.

Protected files

• package-lock.json

The push was rejected because GitHub Actions does not have workflows permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission.

Create the pull request manually

# Download the patch from the workflow run
gh run download 26273456842 -n agent -D /tmp/agent-26273456842

# Create a new branch
git checkout -b deps/safe-updates-2026-05-22-8db84fa3bc47ed47 main

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-26273456842/aw-deps-safe-updates-2026-05-22.patch

# Push the branch and create the pull request
git push origin deps/safe-updates-2026-05-22-8db84fa3bc47ed47
gh pr create --title '[Deps] Safe dependency updates (2026-05-22)' --base main --head deps/safe-updates-2026-05-22-8db84fa3bc47ed47 --repo github/gh-aw-firewall

Generated by Dependency Security Monitor · ● 6.2M · ◷