Updating vally to 0.18.0

[aaronpowell]

No description provided.

[github-actions]

🚦 Submission status: 👀 Ready for review

Risk tier: merge-risk:high — Privileged execution, automation, or review-policy change
Required to merge: passing submission-gate checks plus 2 approvals from reviewers with write access, including a maintainer with admin or maintain permission.

Why this tier

• package-lock.json is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• package.json is a high-risk path (automation, scripts, MCP config, hooks, or review policy)

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	✅ Passed	Passed · logs

Review

• Approvals: 0/2
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 2 more approval(s); an approval from a maintainer with admin or maintain permission
• The core-maintainers pool is not staffed yet; an approver with admin or maintain permission is required instead.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for 2a53811 · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[Copilot]

Copilot review overview

🟢 Approval recommended

The manifest and lockfile are consistent, with no unresolved compatibility issues found.

Review effort: Balanced
Findings: None

What changed in this PR

Updates Vally to 0.18.0 for external-plugin validation.

Changes:

• Pins Vally at 0.18.0.
• Refreshes its transitive dependencies.

File	Description
package.json	Updates the Vally dependency.
package-lock.json	Locks Vally 0.18.0 and dependencies.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.