Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Deps] Safe dependency updates (2026-05-22)

Open
#3,575 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
35/100
Issue type
Refactor
Clarity
Clearly specified
Activity status
Quiet
Tech stack
typescript
Domain
build-system, devops

Research direction

Start with the generated patch from workflow run 26273456842 and apply it to package-lock.json on a new branch as shown in the issue. Run the project test suite and npm audit, checking that only the listed lockfile updates are present and that the known pre-existing failures remain unrelated. Done means the tests and audit meet the stated results and a pull request is created manually.

Written by the indexing model from the issue text.

Description

agentic-workflows automated dependencies

Automated Safe Dependency Updates

This PR contains safe dependency updates within existing semver ranges that have been verified to:

  • ✅ Pass all tests
  • ✅ Have no breaking changes
  • ✅ Address known security vulnerabilities
Updated Dependencies

All packages updated to their wanted versions (within declared semver ranges in package.json). Notable updates include:

Package Previous Updated Type
@babel/preset-env 7.29.2 7.29.5 patch
@commitlint/cli 20.5.0 20.5.3 patch
@commitlint/config-conventional 20.5.0 20.5.3 patch
@eslint/compat 2.0.5 2.1.0 minor
@types/node 25.6.0 25.9.1 minor
@typescript-eslint/eslint-plugin 8.58.2 8.59.4 patch
@typescript-eslint/parser 8.58.2 8.59.4 patch
ajv 8.18.0 8.20.0 minor
babel-jest 30.3.0 30.4.1 minor
eslint 10.2.1 10.4.0 minor
globals 17.5.0 17.6.0 minor
jest 30.3.0 30.4.2 minor
ts-jest 29.4.9 29.4.11 patch
typescript-eslint 8.58.2 8.59.4 patch
Security Fixes Included
  • GHSA-jxxr-4gwj-5jf2 (MODERATE): brace-expansion 5.0.5 → 5.0.6 — Large numeric range defeats documented max DoS protection (CVSS 6.5). Resolved as a transitive dependency update.
Verification
  • All tests pass (2018/2020 — 2 pre-existing failures unrelated to these changes: DNS resolution env issue + /var/tmp permission issue)
  • No breaking changes detected (only package-lock.json modified)
  • npm audit reports 0 vulnerabilities after update
Notes

Only package-lock.json was modified. package.json version ranges are unchanged. The remaining outdated packages (chalk, commander, execa, typescript, etc.) have major version bumps that may include breaking changes and are excluded from this automated update.

Generated by Dependency Security Monitor Workflow

[!WARNING]
Protected Files — Push Permission Denied

This was originally intended as a pull request, but the patch modifies protected files. A human must create the pull request manually.

Protected files
  • package-lock.json

The push was rejected because GitHub Actions does not have workflows permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission.

Create the pull request manually 
# Download the patch from the workflow run
gh run download 26273456842 -n agent -D /tmp/agent-26273456842

# Create a new branch
git checkout -b deps/safe-updates-2026-05-22-8db84fa3bc47ed47 main

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-26273456842/aw-deps-safe-updates-2026-05-22.patch

# Push the branch and create the pull request
git push origin deps/safe-updates-2026-05-22-8db84fa3bc47ed47
gh pr create --title '[Deps] Safe dependency updates (2026-05-22)' --base main --head deps/safe-updates-2026-05-22-8db84fa3bc47ed47 --repo github/gh-aw-firewall

Generated by Dependency Security Monitor · ● 6.2M · ◷

Dominant language
TypeScript
Stars
145
Forks
63
Avg merge
6h 22m
Merged PRs (30d)
232

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/gh-aw-firewall

All issues in github/gh-aw-firewall

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.