[Deps] Safe dependency updates (2026-08-30)

[github-actions]

Automated Safe Dependency Updates

This PR contains safe patch-level dependency updates that have been verified to:

• ✅ Pass all tests (except 4 pre-existing failures unrelated to this change, see below)
• ✅ Have no breaking changes
• ✅ Build and lint successfully (npm run build, npm run lint — 0 errors)

Updated Dependencies

Package	Previous	Updated	Type
js-yaml	5.3.0	5.4.1	patch
eslint	10.9.0	10.9.1	patch
babel-jest	30.4.1 (resolved)	30.5.0 (resolved)	patch (lockfile refresh, no manifest change needed — caret range already allows it)
jest	30.4.2 (resolved)	30.5.0 (resolved)	patch (lockfile refresh, no manifest change needed — caret range already allows it)

Security Fixes Included

None — npm audit reported 0 vulnerabilities, and this run's GitHub token lacked security_events scope so Dependabot alerts could not be queried (reported separately via missing_tool). These are routine patch bumps only.

Verification

• npm audit — 0 vulnerabilities
• npm install succeeds, lockfile updated
• npm test — 5239/5266 tests pass. The 4 failing suites (docker-manager-diagnostics.test.ts, enclave/manager.test.ts, enclave/mount-policy.test.ts, enclave/agent-entrypoint-diagnostics.test.ts) fail identically on the base branch (db156aa, verified via git stash) due to a missing /var/tmp directory in this sandbox environment — unrelated to these dependency updates.
• npm run build (tsc) succeeds
• npm run lint — 0 errors (1827 pre-existing warnings, unrelated)

Notes

Larger available updates (e.g. commander 12→15, chalk 4→6, execa 5→10, typescript 5→7, @babel/* 7→8) were intentionally not applied — these are major version bumps that may include breaking changes and require dedicated review/testing, not a "safe" automated patch update.

No existing open [Deps]-prefixed PR was found prior to creating this one.

---

Generated by Dependency Security Monitor Workflow

---

Warning

Protected Files

This was originally intended as a pull request, but the patch modifies protected files. These files may affect project dependencies, CI/CD pipelines, or agent behaviour. Please review the changes carefully before creating the pull request.

Click here to create the pull request once you have reviewed the changes

Protected files

• package-lock.json

• package.json

To route changes like this to a review issue instead of blocking, configure protected-files: fallback-to-issue in your workflow configuration.

Generated by Dependency Security Monitor · copilot · auto · 51.6 AIC · ⊞ 13.2K · ◷