[repo-assist] build(deps): bump patch/minor dev dependencies

[github-actions]

🤖 This is an automated PR from Repo Assist.

Summary

Bumps several dev-only dependencies to their latest patch/minor versions:

• @types/node 26.2.0 -> 26.4.0
• @typescript-eslint/eslint-plugin 8.67.0 -> 8.68.0
• @typescript-eslint/parser 8.67.0 -> 8.68.0
• eslint 10.8.1 -> 10.9.1

All are patch/minor bumps for dev-only tooling (typings, linter). No source code changes required. Major bumps (tree-sitter, typescript, @types/vscode) are intentionally excluded and already tracked by other open PRs (#501, #455) or blocked on peer-dependency issues.

Test Status

• npm run compile: ✅ clean
• npm run lint: ✅ clean
• npm run test:unit: ✅ 241 passing, coverage 98.77/95.16/99.10/98.77 (above 95/88/97/95 thresholds)
• npm audit --omit=dev: ✅ 0 vulnerabilities
• vscode-test (full E2E): not run — blocked by sandbox network restrictions (expected, documented in prior runs)

Trade-offs

None identified — straightforward dev-dependency patch/minor bumps.

---

Warning

Protected Files — Push Permission Denied

This was originally intended as a pull request, but the patch modifies protected files. A human must create the pull request manually.

Protected files

• package-lock.json

• package.json

The push was rejected because GitHub Actions does not have workflows permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission.

Create the pull request manually

# Download the patch from the workflow run
gh run download 33323944394 -n agent -D /tmp/agent-33323944394

# Create a new branch
git checkout -b repo-assist/eng-patch-deps-20260830-7de6eaf4fefcf064 main

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-33323944394/aw-repo-assist-eng-patch-deps-20260830.patch

# Push the branch and create the pull request
git push origin repo-assist/eng-patch-deps-20260830-7de6eaf4fefcf064
gh pr create --title '[repo-assist] build(deps): bump patch/minor dev dependencies' --base main --head repo-assist/eng-patch-deps-20260830-7de6eaf4fefcf064 --repo askpt/code-metrics

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• releaseassets.githubusercontent.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "releaseassets.githubusercontent.com"

See Network Configuration for more information.

Generated by 🌈 Repo Assist, see workflow run. Learn more.
_{Comment /repo-assist to run again}

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@42c2ab5b4e4c9273534c39259b2e0df7f20f07e9