[Deps] Safe dependency updates 2026-03-10

[github-actions]

Automated Safe Dependency Updates

This PR contains safe patch/minor-level dependency updates that have been verified to:

• ✅ Pass all tests (828 passing, 3 pre-existing failures unchanged)
• ✅ Have no breaking changes
• ✅ Address no new security vulnerabilities (npm audit shows 0 vulnerabilities)

Updated Dependencies

Package	Previous	Updated	Type
@commitlint/cli	20.4.1	20.4.3	patch
@commitlint/config-conventional	20.4.1	20.4.3	patch
@eslint/compat	2.0.2	2.0.3	patch
@types/node	25.2.3	25.4.0	minor
@typescript-eslint/eslint-plugin	8.55.0	8.57.0	minor
@typescript-eslint/parser	8.55.0	8.57.0	minor
eslint	10.0.0	10.0.3	patch
glob	13.0.1	13.0.6	patch
globals	17.3.0	17.4.0	minor
typescript-eslint	8.55.0	8.57.0	minor

Security Status

• npm audit: 0 vulnerabilities found (CRITICAL: 0, HIGH: 0, MODERATE: 0, LOW: 0)
• No Dependabot alerts accessible for comparison

Skipped Updates (major version bumps with breaking changes)

• chalk 4.x → 5.x (ESM-only, breaking)
• commander 12.x → 14.x (major breaking changes)
• eslint-plugin-security 3.x → 4.x (major)
• execa 5.x → 9.x (major rewrite, ESM-only)

Verification

• All tests pass (828/831 — 3 pre-existing failures unrelated to updates)
• No breaking changes detected
• npm audit clean after updates

---

Generated by Dependency Security Monitor Workflow

AI generated by Dependency Security Monitor

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	82.37%	82.51%	📈 +0.14%
Statements	82.27%	82.41%	📈 +0.14%
Functions	82.60%	82.60%	➡️ +0.00%
Branches	74.21%	74.30%	📈 +0.09%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/docker-manager.ts	83.4% → 84.0% (+0.54%)	82.8% → 83.3% (+0.52%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

C++ Build Test Results

Project	CMake	Build	Status
fmt	✅	✅	PASS
json	✅	✅	PASS

Overall: PASS ✅

Generated by Build Test C++ for issue #1199

[github-actions]

Build Test: Deno

Project	Tests	Status
oak	1/1	✅ PASS
std	1/1	✅ PASS

Overall: ✅ PASS

Generated by Build Test Deno for issue #1199

[github-actions]

Go Build Test Results

Project	Download	Tests	Status
color	✅	1/1	PASS
env	✅	1/1	PASS
uuid	✅	1/1	PASS

Overall: PASS ✅

Generated by Build Test Go for issue #1199

[github-actions]

Merged PRs reviewed: fix(ci): resolve integration test suite failures on main; fix(security): eliminate TOCTOU race conditions in ssl-bump.ts ✅
Safeinputs GH PR list ✅
Playwright GitHub title ✅
Tavily search ❌
File write ✅
Bash cat ✅
Discussion comment ✅
Build (npm ci && npm run build) ✅
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex for issue #1199

[github-actions]

Build Test: Node.js Results

Project	Install	Tests	Status
clsx	✅	PASS	✅ PASS
execa	✅	PASS	✅ PASS
p-limit	✅	PASS	✅ PASS

Overall: ✅ PASS

All 3 Node.js projects installed and tested successfully.

Generated by Build Test Node.js for issue #1199

[github-actions]

🦀 Rust Build Test Results

Project	Build	Tests	Status
fd	✅	1/1	PASS
zoxide	✅	1/1	PASS

Overall: ✅ PASS

Generated by Build Test Rust for issue #1199

[github-actions]

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.12	Python 3.12.3	❌ NO
Node.js	v24.14.0	v20.20.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: ❌ Not all tests passed. Go matches, but Python and Node.js versions differ between host and chroot environments.

Tested by Smoke Chroot for issue #1199

[github-actions]

Smoke Test Results

✅ GitHub MCP: Last 2 merged PRs retrieved

• fix(ci): resolve integration test suite failures on main #1151: fix(ci): resolve integration test suite failures on main
• fix(security): eliminate TOCTOU race conditions in ssl-bump.ts #1159: fix(security): eliminate TOCTOU race conditions in ssl-bump.ts

✅ Playwright: github.com title contains "GitHub"

✅ File Write: /tmp/gh-aw/agent/smoke-test-claude-22929864988.txt created

✅ Bash: File verified via cat

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude for issue #1199

[Mossaka]

Closing in favor of an aggregated dependency update PR that combines all pending updates. This reduces PR noise and CI load.