[dependabot-agent] Bump eslint, typescript-eslint, and `@types/node`

[cao-githubnext-gh-aw-cao-write]

Caution

Protected files were modified in this change.
This pull request is in request-review mode and requires explicit human scrutiny before merge.

Protected files: package-lock.json, package.json

Dependency Release Train Summary

What changed

• Package/ecosystem: npm (root)
• Manifest(s): package.json, package-lock.json
• Old version → New version:
  • eslint: 10.9.1 → 10.10.0
  • @typescript-eslint/eslint-plugin: 8.67.0 → 8.70.0
  • @typescript-eslint/parser: 8.67.0 → 8.70.0
  • typescript-eslint: 8.67.0 → 8.70.0
  • @types/node: ^25.9.5 → ^25.9.6
• Update type: patch/minor (no majors)

Why now

• Routine freshness bump. No open Dependabot PRs, no open security advisories/alerts
  on this repo at time of this run. This closure was previously identified as the
  next coherent freshness bundle in prior cache-memory runs but does not appear to
  have landed on main yet (current main still pins the old versions), so it is
  re-submitted here.

Risk assessment

• Runtime/dev/build/CI scope: dev-only (lint/typecheck tooling + Node type defs);
  does not affect the production dist/cli.js runtime bundle or container images.
• Direct/transitive: all five are direct devDependencies in the root package.json.
• Reachability: used via eslint.config.mjs (flat config) and tsconfig*.json
  during npm run lint / npm run type-check / CI; no application source changes
  needed.
• These four packages (eslint, typescript-eslint, @typescript-eslint/eslint-plugin,
  @typescript-eslint/parser) are bundled together as one atomic closure because
  they share a single ESLint flat-config resolver invocation and must stay
  version-aligned; @types/node is a small unrelated patch-only bump riding along
  in the same manifest (zero additional risk).
• Peer dependency compatibility verified before bumping: @typescript-eslint/eslint-plugin@8.70.0
  requires @typescript-eslint/parser: ^8.70.0 (satisfied) and
  eslint: ^8.57.0 || ^9.0.0 || ^10.0.0 (satisfied by eslint@10.10.0) and
  typescript: >=4.8.4 <6.1.0 (repo pins typescript: ^5.9.3, unchanged, satisfied).

Validation

• Commands run:
  • npm install --package-lock-only --registry=https://registry.npmjs.org/ --legacy-peer-deps — succeeded, regenerated package-lock.json cleanly (repo's own .npmrc points at an internal registry unreachable from this sandbox; public registry used for read-only resolution only).
  • npm audit --package-lock-only --registry=https://registry.npmjs.org/ — 0 vulnerabilities, both before and after.
  • npm outdated --registry=https://registry.npmjs.org/ — confirms all five targeted packages now resolve to their intended wanted/latest versions.
  • JSON validity check (python3 -m json.load) on both package.json and package-lock.json — OK.
  • git diff --stat — exactly 2 files changed (package.json, package-lock.json), zero unrelated churn.
  • Partial npm install --ignore-scripts (killed after the sandbox's documented npm-stall limitation) had already resolved and installed all five target packages into node_modules before being interrupted; spot-checked each package's own node_modules/*/package.json "version" field to confirm eslint@10.10.0, typescript-eslint@8.70.0, @typescript-eslint/{eslint-plugin,parser}@8.70.0, and @types/node@25.9.6 all resolve/install correctly.
• Result: lockfile-only resolution and audit both clean; version bumps confirmed installable.
• Remaining gaps: could not run npm run lint / npm run type-check / npm test to completion — full npm install/npm ci against the public registry reliably stalls in this sandbox (this repo's internal registry is unreachable here). CI is the source of truth for lint/typecheck/test signal on this PR.

Control Plane

• Correlation ID: 34558682839-1072
• Central repo: githubnext/gh-aw-cao
• Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34558682839

Sensitive surface area

• None — dev-tooling only (linting/type-checking), no auth/crypto/payment/DB/serialization/telemetry/CI-runner/container-base changes.

Breaking-change notes

• None (no major version bumps).

Reviewer checklist

• CI passes
• CODEOWNERS or service owners reviewed
• Security-sensitive areas approved, if applicable
• Deployment/canary owner confirms runtime health, if needed

Rollback guidance

• Revert this PR, or manually pin eslint back to 10.9.1, @typescript-eslint/eslint-plugin/@typescript-eslint/parser/typescript-eslint back to 8.67.0, and @types/node back to ^25.9.5 in package.json, then regenerate package-lock.json.
• package.json and package-lock.json must be reverted together.

Smart-Dependabot-Merge-Candidate: yes

---

Note

This was originally intended as a pull request, but the git push operation failed.

Original error: The process '/usr/bin/git' failed with exit code 128

Workflow Run: View run details and download bundle artifact

The bundle file is available in the agent artifact in the workflow run linked above.

Create the pull request manually

# Download the artifact from the workflow run
gh run download '34558682839' -n agent -D '/tmp/agent-34558682839'

# Resolve the bundle source ref, fetch it into a temporary ref, then create the local branch
bundle_path='/tmp/agent-34558682839/aw-github-gh-aw-firewall-dependabot-agent-eslint-typescript-eslint-types-node-20260911033650.bundle'
temp_ref='refs/bundles/create-pr-dependabot-agent-eslint-typescript-eslint-types-node-20260911033650-ac284b19'
target_ref='refs/heads/dependabot-agent/eslint-typescript-eslint-types-node-20260911033650'
bundle_source_ref=$(git bundle list-heads "$bundle_path" | awk '$2 ~ /^refs\/heads\// { print $2 }')
if [ -z "$bundle_source_ref" ]; then
  bundle_source_ref=$(git bundle list-heads "$bundle_path" | awk '$2 == "HEAD" { print $2 }')
fi
if [ "$(printf '%s\n' "$bundle_source_ref" | sed '/^$/d' | wc -l | tr -d ' ')" != "1" ]; then
  echo "Expected exactly one bundle source ref, found: $bundle_source_ref" >&2
  exit 1
fi
git fetch "$bundle_path" "${bundle_source_ref}:${temp_ref}"
git update-ref "$target_ref" "$temp_ref"
git checkout 'dependabot-agent/eslint-typescript-eslint-types-node-20260911033650'
# Ensure the working tree matches the updated branch
git reset --hard
# Remove the temporary bundle ref
git update-ref -d "$temp_ref"

# Push the branch to the target remote
git push 'origin' 'dependabot-agent/eslint-typescript-eslint-types-node-20260911033650'

# Create the pull request
gh pr create --title '[dependabot-agent] Bump eslint, typescript-eslint, and `@types/node`' --base 'main' --head 'dependabot-agent/eslint-typescript-eslint-types-node-20260911033650' --repo 'github/gh-aw-firewall'

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

Generated by Dependabot / Release Trains · copilot · auto · 103.8 AIC · ⌖ 27.2 AIC · ⊞ 18.8K · ◷

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main