[bacluc-agent]

https://github.com/bacluc-agent/agent-todo/issues/369

Management summary

npm ci emitted npm warn deprecated glob@10.5.0 because gcp-metadata@8.1.4 exact-pins gaxios@7.1.3, the only gaxios version that carries rimraf@^5.0.1, which pulls the deprecated glob@10.5.0. Adding an npm overrides entry for gaxios ^7.3.1 (same major; already resolved by google-auth-library and gtoken in this tree) makes npm drop the rimraf/glob@10 subtree from the lockfile, so the warning disappears. No declared dependency version changed (dependencies/devDependencies untouched); the lockfile change is deletion-only (0 insertions, 417 deletions), and only this one deprecation class is addressed.

Verification evidence

Only the fork run below was triggered explicitly by us via workflow_dispatch (head 43eb9f8a); the upstream run is cited as the pre-existing problem, and automatic push-/PR-triggered workflows are not claimed as our testing.

Problem run (pre-existing upstream run, not ours), step 4 Run npm ci shows the glob@10.5.0 deprecation we fix:
https://github.com/BacLuc/opencode-completion-check-command/actions/runs/38853014052/job/116818200659#step:4

Our dispatched run 38857110527 (fork bacluc-agent/opencode-completion-check-command, job 116830963482, head 43eb9f8), covering every changed path — package-lock.json via npm ci, package.json via typecheck and format:check:

• step 4 Run npm ci — the only deprecation is now node-domexception@1.0.0; glob@10.5.0 is absent:
  https://github.com/bacluc-agent/opencode-completion-check-command/actions/runs/38857110527/job/116830963482#step:4
• step 5 Run npm run typecheck — success:
  https://github.com/bacluc-agent/opencode-completion-check-command/actions/runs/38857110527/job/116830963482#step:5
• step 6 Run npm test — success:
  https://github.com/bacluc-agent/opencode-completion-check-command/actions/runs/38857110527/job/116830963482#step:6
• step 7 Run npm run format:check — success:
  https://github.com/bacluc-agent/opencode-completion-check-command/actions/runs/38857110527/job/116830963482#step:7

Run	Model	What happened	Result	Failure reason
38853014052 step 4	—	upstream npm ci	deprecated glob@10.5.0 warning	deprecated glob@10.5.0
38857110527 step 4	opencode/big-pickle	npm ci on fixed tree	success	—
38857110527 step 5	opencode/big-pickle	npm run typecheck	success	—
38857110527 step 6	opencode/big-pickle	npm test	success	—
38857110527 step 7	opencode/big-pickle	npm run format:check	success	—

Rationale and out of scope

Why an overrides entry and not a version bump. Renovate's npm manager extracts package.json overrides as its own dependency type, so once this entry is merged Renovate keeps it updated like any other dependency (minimumReleaseAge/automerge/labels apply as usual). Two caveats: this repo's renovate.json has no overrides-specific rule, and Renovate can only update an existing override — it cannot add one, so this initial entry is a one-time manual addition. No declared dependency version (dependencies/devDependencies) is changed.

Accepted risk: overriding an exact pin. gcp-metadata@8.1.4 declares gaxios: "7.1.3" exactly; this override deliberately replaces that exact pin with the same-major 7.3.1 that google-auth-library@10.5.0/gtoken@8.0.0 already resolve in this tree. Nothing in src/ or tests/ imports gaxios, and google-auth-library releases up to 11.3.0 still require gaxios@^7.1.4 (only the not-yet-used 11.3.1 moved to ^8.3.0), so there is no conflict today. If a future dependency requires gaxios@8, npm would install 7.3.1 anyway and npm ls would still exit 0, so such a bump must ship an override update in the same change.

Out of scope for this run (one deprecation class only):

• node-domexception@1.0.0 is deferred. Every published version of that package is deprecated, fetch-blob@3.2.0 and fetch-blob@4.0.0 both depend on it, and node-fetch's stable line is 3.3.2, which pulls it in. There is no clean upgrade path that removes it.
• The Node 20 deprecation warning emitted by projectsyn/pr-label-tag-action in the Autorelease workflow is deferred (no node24 release of that action exists yet; GitHub force-runs it on node24, so it is warning-only).

Changed paths

• package.json — adds overrides (3 insertions, 0 deletions)
• package-lock.json — 0 insertions, 417 deletions (removes the rimraf/glob@10 subtree)