[Deps] Safe dependency updates (2026-09-13) #8507

Automated Safe Dependency Updates

This PR contains safe patch-level dependency updates that have been verified to:

• ✅ Pass the full test suite (no new failures vs. base branch)
• ✅ Have no breaking changes (patch-level semver bumps only)
• ✅ npm audit reports 0 vulnerabilities (no CVEs to address)

Updated Dependencies

Security Fixes Included

None. npm audit --registry https://registry.npmjs.org reported 0 vulnerabilities (critical/high/moderate/low) at the time of this run, and no Dependabot alerts are currently open for this repository.

Verification

• npm run build (tsc) succeeds
• Full test suite run: 5825/5858 tests pass on both the base branch and this branch. The 33 failing tests (7 suites: enclave/mount-policy, enclave/github-gateway, enclave/dynamic-delegation*, docker-manager-diagnostics, enclave/manager) fail identically before and after these updates — root cause is /var/tmp not being creatable in this sandbox environment (pre-existing environment limitation, unrelated to dependency versions).
• No breaking changes detected (all bumps are patch-level per semver)

Notes

• Other outdated packages (chalk, commander, execa, typescript, @babel/*, jest, etc.) have available updates but are minor/major version bumps requiring more careful review and were intentionally excluded from this conservative, patch-only update batch.
• js-yaml in dependencies was previously exact-pinned (no ^); this update preserves that exact pinning at the new patch version.

Generated by Dependency Security Monitor Workflow

• package.json

To route changes like this to a review issue instead of blocking, configure protected-files: fallback-to-issue in your workflow configuration.

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"

Generated by Dependency Security Monitor · copilot · auto · 48.5 AIC · ⊞ 11.5K · ◷