global-agent@3 pulls the deprecated boolean@3.2.0 — PR #220 already fixes it

[erictheswift]

Installing changesets-gitlab@0.14.0 surfaces a deprecation warning that originates entirely
inside its dependency tree:

[WARN] deprecated boolean@3.2.0: Package no longer supported.

boolean is permanently unmaintained — 3.2.0 is simultaneously the latest and the deprecated
version, so there is no upgrade path. The only fix is to stop pulling the edge.

Where it comes from

changesets-gitlab@0.14.0 depends on global-agent@^3.0.0, which reaches boolean twice:

changesets-gitlab@0.14.0
└─ global-agent@3.0.0
   ├─ boolean@3.2.0          ← direct
   └─ roarr@2.15.4
      └─ boolean@3.2.0       ← transitive

The fix already exists as PR #220

Renovate's open PR #220 includes global-agent ^3.0.0 → ^4.0.0, which resolves both edges:

global-agent	boolean	roarr
3.0.0 (current)	direct dep	2.15.4 → boolean
4.1.0	dropped	still present (roarr 7.x, no boolean)
4.1.2+	dropped	dropped

global-agent@4.1.3 deps are just globalthis, matcher, semver, serialize-error — no
boolean on any path. So merging #220 (or cherry-picking just the global-agent bump) clears
the warning.

Compatibility looks clean

src/api.ts is the only consumer, and it uses three things — all still present in 4.1.3:

• import { bootstrap } from 'global-agent' — still exported (dist/index.js
  re-exports it from ./routines)
• import type { ProxyAgentConfigurationType } — still exported from dist/types.d.ts,
  and the shape you rely on is unchanged
  (environmentVariableNamespace, forceGlobalAgent, socketConnectionTimeout, ca?)
• the global.GLOBAL_AGENT[...] mutation — unaffected

Still CJS, and engines moved >=10.0, comfortably inside your >=18.0.0.

One packaging wrinkle worth knowing

global-agent@4.1.3 sets "typings": "./dist/src/index.d.ts", but the file actually ships at
./dist/index.d.ts — that path does not exist in the tarball. In practice this is harmless for
you because you still have @types/global-agent@^3.0.0 in devDependencies, and it continues
to declare both bootstrap and ProxyAgentConfigurationType correctly.

So: keep @types/global-agent when taking the v4 bump. Dropping it on the assumption that v4
is self-typed would break src/api.ts typecheck until the upstream typings path is fixed.

Why I'm filing rather than just waiting

We consume changesets-gitlab in a pnpm monorepo and are currently working around this with a
scoped override:

overrides:
  "changesets-gitlab@0.14.0>global-agent": 4.1.3

That works, but it is pinned to changesets-gitlab@0.14.0 and silently stops applying on your
next release — so an upstream bump is meaningfully better for downstream consumers than every
one of us maintaining a private override.

Happy to open a focused PR that bumps only global-agent if you'd prefer that over merging the
full dependency sweep in #220.