fix(dependabot): bump the npm-dependencies group across 1 directory with 13 updates

[dependabot]

Bumps the npm-dependencies group with 13 updates in the / directory:

Package	From	To
@octokit/types	16.0.0	18.0.0
@redocly/cli	2.34.0	2.52.1
ignore	7.0.5	7.0.9
@typeform/eslint-config	7.0.17	7.1.0
@types/node	26.0.0	26.5.1
esbuild	0.28.1	0.28.2
eslint	10.5.0	10.10.0
js-yaml	5.0.0	5.4.1
lint-staged	17.0.8	17.5.1
prettier	3.8.4	3.9.6
semantic-release	25.0.3	25.0.9
typescript	6.0.3	7.0.2
vitest	4.1.9	5.0.0

Updates @octokit/types from 16.0.0 to 18.0.0

Release notes

Sourced from @​octokit/types's releases.

v18.0.0

18.0.0 (2026-08-29)

Features

• update endpoints with major additions as of 2026-08-24 (#723) (c4b93f2)

BREAKING CHANGES

• remove deprecated endpoints

v17.0.0

17.0.0 (2026-08-01)

Features

• drop projects-classic endpoints, add GitHub API endpoints: cache limits (retention & storage) for repos/orgs/enterprises, billing budgets & usage, artifacts deployment metadata, and projectsV2 drafts & fields (#713) (0296144)

BREAKING CHANGES

• Removed /orgs/{org}/projects
• Removed /orgs/{org}/settings/billing/actions
• Removed /orgs/{org}/settings/billing/packages
• Removed /orgs/{org}/settings/billing/shared-storage
• Removed /orgs/{org}/teams/{team_slug}/projects
• Removed /orgs/{org}/teams/{team_slug}/projects/{project_id}
• Removed /projects/columns/{column_id}
• Removed /projects/columns/{column_id}/moves
• Removed /projects/{project_id}
• Removed /projects/{project_id}/collaborators
• Removed /projects/{project_id}/collaborators/{username}
• Removed /projects/{project_id}/collaborators/{username}/permission
• Removed /repos/{owner}/{repo}/projects
• Removed /teams/{team_id}/projects
• Removed /teams/{team_id}/projects/{project_id}
• Removed /user/projects
• Removed /users/{username}/projects
• Removed /users/{username}/settings/billing/actions
• Removed /users/{username}/settings/billing/packages
• Removed /users/{username}/settings/billing/shared-storage

Commits

• c4b93f2 feat: update endpoints with major additions as of 2026-08-24 (#723)
• 4d46114 chore(deps): Temporarily disable docs generation/publish in release workflow...
• dd020c1 build(deps-dev): remove semantic-release, bump prettier (#719)
• 8b92916 build(deps-dev): bump markdown-it from 14.1.0 to 14.3.0 (#717)
• f88ca90 build(deps-dev): bump lodash-es from 4.17.23 to 4.18.1 (#718)
• 66f2dd6 build(deps-dev): bump brace-expansion from 2.0.1 to 2.0.2 (#715)
• ce4890d build(deps-dev): bump linkify-it from 5.0.0 to 5.0.2 (#716)
• afd965b build(deps-dev): bump npm from 11.6.2 to 11.19.0 (#714)
• e9121d4 build(deps-dev): bump lodash-es from 4.17.21 to 4.17.23 (#700)
• 0296144 feat: drop projects-classic endpoints, add GitHub API endpoints: cache limits...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​octokit/types since your current version.

Updates @redocly/cli from 2.34.0 to 2.52.1

Release notes

Sourced from @​redocly/cli's releases.

@​redocly/cli@​2.52.1

Patch Changes

• Updated redoc to the 2.5.4 version to fix accessibility problems in the HTML produced by build-docs. Added the lang attribute to the default build-docs template.

@​redocly/cli@​2.52.0

Minor Changes

• Added agent skills for AI coding assistants: redocly-cli for everyday CLI usage, redocly-lint-rules for writing configurable rules and custom plugins. Install them with npx skills add https://redocly.com.
• Added an experimental inspect-node-types command to navigate the Redocly's node type tree of an API description. inspect-node-types helps pick the correct subject types for a configurable rule or the correct visitor for a custom plugin.
• Added a strategy option to the component-name-unique rule, matching the --component-names-strategy option of the bundle command.
• Added an experimental introspect-mcp command that analyzes a running MCP server and records its tools, prompts, resources, and capabilities. introspect-mcp records its findings in the x-mcp extension of an OpenAPI description.

Patch Changes

• Updated @​redocly/openapi-core to v2.52.0.

@​redocly/cli@​2.51.2

Patch Changes

• Updated fast-uri to the 3.1.7 version to resolve CVE-2026-75931, CVE-2026-75975, CVE-2026-75899, and CVE-2026-76172.
• Fixed drift and coverage failing to match a path template whose segment mixes literal text with parameters, such as /instances/{worldId}:{instanceId}.
• Fixed an issue where Redocly config resolution failed when plugins used ESM syntax.
• Updated @​redocly/openapi-core to v2.51.2.

@​redocly/cli@​2.51.1

Patch Changes

• Fixed an issue where generate-arazzo produced a malformed remote description URL in sourceDescriptions (https:// collapsed to https:/) when --output-file was provided.
• Fixed an issue where $faker.string.email() used without options generated addresses at the undefined.com domain.
• Updated @​redocly/respect-core to v2.51.1.
• Updated @faker-js/faker to the 10.6.0 version to resolve the high severity advisory GHSA-qxc2-j82w-r537.

@​redocly/cli@​2.51.0

Minor Changes

• Enhanced the generate-arazzo command to print a ready-to-run respect command after generation, including an --input placeholder for every workflow input.
• Added --with-ai, --ai-provider, --ai-model, --ai-concurrency, and --max-workflows options to the generate-arazzo command. --with-ai uses a local AI CLI (claude, codex, or cursor) and OpenAPI descriptions to redesign the generated one-workflow-per-operation skeleton into multi-step workflows. The AI designs at most --max-workflows workflows (default 10), and the generated file is marked as AI-inferred. For descriptions that don't fit a single prompt, the AI first selects scenarios from a compact operation index, then it designs each workflow separately.

Patch Changes

• Fixed an issue where respect and the x-security-scheme-required-values rule incorrectly rejected x-security HTTP schemes written with non-lowercase casing (such as Basic, Bearer, or Digest). RFC 7235 scheme names are case-insensitive.

... (truncated)

Commits

• 3fa9963 chore: 🔖 release new versions (#3110)
• e15102c docs: mention the redocly-lint-rules skill (#3102)
• 1fa5819 fix: bump @​redocly/mock-server to 0.11.0-next.2 (#3109)
• 93c155f fix: update redoc to 2.5.4 to resolve accessibility issues in build-docs (#3107)
• 2586b31 chore: 🔖 release new versions (#3094)
• 90bb574 chore: update redocly config to v0.56.0 (#3105)
• af8c9bd feat: add introspect-mcp command (#3101)
• abc3555 feat: add support for the strategy parameter in component-name-unique rule (#...
• b14e21a docs: add info about boolean values should be false (#3103)
• 8447573 chore: update changelog for v1 (#3100)
• Additional commits viewable in compare view

Updates ignore from 7.0.5 to 7.0.9

Release notes

Sourced from ignore's releases.

7.0.8

PATCH Brings pattern matching closer to git:

• PATCH A backslash now makes the next character a literal, exactly as git does: \* matches a literal * rather than acting as a wildcard, \? matches a literal ?, and \d, \b, \/ and the like are the plain characters instead of regular-expression escapes.
• PATCH Only a trailing run of spaces is stripped from a pattern — never tabs or other whitespace — and a line of only tabs is treated as a pattern rather than a blank line, matching git.

An upgrade is recommended for all dependents.

Commits

• 821765e #166: bump version 7.0.9
• e00d35e Merge pull request #167 from bentbrain/fix-bom-blank-line
• 9b6481f fix(ignore): reject BOM-only blank lines before compilation
• 20b802a bump version 7.0.8
• 0414358 build: require 100% coverage of index.js as an explicit gate
• 968aee6 compat: check compatibility by running old versions' test suites
• 8e46220 build: run the compatibility gate as part of npm test
• 6e81fb2 tidy up how wildcards compile
• ea3d5eb fix: a backslash quotes the next character, and only spaces are trimmed
• 01cfbbb docs: document the known, deliberate differences from git
• Additional commits viewable in compare view

Updates @typeform/eslint-config from 7.0.17 to 7.1.0

Release notes

Sourced from @​typeform/eslint-config's releases.

v7.1.0

7.1.0 (2026-09-17)

Features

• add coverage to default ignores (#149) (9cd23e1)

v7.1.0-beta.11

7.1.0-beta.11 (2025-11-03)

Bug Fixes

• update publish command to use process.env.GH_TOKEN for authentication (06a167a)

v7.1.0-beta.10

7.1.0-beta.10 (2025-11-03)

Bug Fixes

• update publish command to use env.GH_TOKEN for authentication (4523ddd)

v7.1.0-beta.9

7.1.0-beta.9 (2025-11-03)

Bug Fixes

• update publish command to correctly reference GH_TOKEN variable (ad821ea)
• update publish command to use envCi.GH_TOKEN for authentication (8e24fc3)

v7.1.0-beta.8

7.1.0-beta.8 (2025-11-03)

Bug Fixes

• update publish commands to streamline GitHub publishing process (9f16991)

v7.1.0-beta.7

7.1.0-beta.7 (2025-11-03)

Bug Fixes

• update publish:github script to include beta tag for npm publish (9963e24)

v7.1.0-beta.6

... (truncated)

Commits

• 9cd23e1 feat: add coverage to default ignores (#149)
• 9e72128 fix(PLT-3494): removed exception for semantic release updates (#148)
• 88c632d fix(dependabot): bump @​humanfs/node from 0.16.7 to 0.16.8 (#145)
• c323c13 fix(dependabot): bump browserslist from 4.26.3 to 4.28.9 (#144)
• a829edb fix(dependabot): bump postcss-selector-parser from 7.1.0 to 7.1.6 (#143)
• 2d70de2 fix(dependabot): bump ip-address from 10.2.0 to 10.4.0 (#140)
• a886c18 build(dependabot): bump actions/setup-node (#137)
• 749d45d fix(dependabot): bump @​babel/core from 7.29.0 to 7.29.7 (#133)
• 6d04088 ci: use JENKINS_PAT_TOKEN instead of GH_TOKEN (#142)
• 6d3c1c4 build(dependabot): bump the dependencies group across 1 directory with 2 upda...
• Additional commits viewable in compare view

Updates @types/node from 26.0.0 to 26.5.1

Commits

• See full diff in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix
• c625d31 fix #4497: preserve nested ampersands during minification (#4500)
• 34474e2 better isolation of current part in js parser
• 07f6e8c fix #4507: import assignment tree-shaking bug
• Additional commits viewable in compare view

Updates eslint from 10.5.0 to 10.10.0

Release notes

Sourced from eslint's releases.

v10.10.0

Features

• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
• c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
• 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
• 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
• 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
• 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

• 2417cad docs: Update README (GitHub Actions Bot)
• 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
• 8724829 docs: update compat table links (#21263) (fnx)
• 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

• b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296) (renovate[bot])
• 3c753f1 chore: update eslint (#21289) (renovate[bot])
• 1c73469 chore: update ecosystem plugins (#21280) (ESLint Bot)
• 08a02be test: add error locations to no-extra-boolean-cast (#21266) (lumir)
• 77bb1db chore: update github/codeql-action action to v4.37.8 (#21270) (renovate[bot])
• 007e81a ci: skip EMFILE test on Node.js 26 (#21265) (lumir)
• 0430280 chore: improve ecosystem tests compatibility on Windows (#21178) (crimsonjay0)

v10.9.1

Bug Fixes

• 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)

Documentation

• ad74a8d docs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)

Chores

• 3c3ae53 chore: update ecosystem plugins (#21249) (ESLint Bot)

v10.9.0

Features

• 08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)
• 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

• 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)
• 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)
• 684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

... (truncated)

Commits

• 3f20a57 10.10.0
• f4e5284 Build: changelog update for 10.10.0
• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801)
• 427ac0a fix: use format strings in debug calls (#21247)
• b3d876b chore: disable npm audit in ecosystem tests (#21306)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261)
• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297)
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282)
• Additional commits viewable in compare view

Updates js-yaml from 5.0.0 to 5.4.1

Changelog

Sourced from js-yaml's changelog.

[5.4.1] - 2026-08-26

Changed

• Hard-limit merge sequence size to 100.

Security

• Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

• Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

• [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
• [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
• Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

• Accept a byte order mark at the start of each document in a stream, #791.
• Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.
• Preserve empty scalar items when converting block sequences to flow style.
• Do not apply the 1024-character simple-key limit to flow mapping keys.
• Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
• Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

[5.3.0] - 2026-08-14

This release focuses on reworking the documentation and making small architectural improvements before moving forward.

Added

• Added completely new documentation.
• Exported DUMP_SCHEMA, the default schema used by the dumper.
• Added YAMLException.throwAt() for throwing an error at a source position.

Changed

... (truncated)

Commits

• e5a3ba0 5.4.1 released
• e54dea3 Hard-limit merge sequence size to 100
• dfd3a29 Cleanup 6a8e05f, #797
• 6a8e05f fix: count empty merge sources against maxTotalMergeKeys (#797)
• 6b4ff5e 5.4.0 released
• 3b3625e Update changelog
• 4f25a74 Fix file name
• 3bd003b Expose new scalar styling API
• fbb3e9d Remove regex lookbehind for ES2015 compatibility
• d43c185 Fix flowSkipColonSpace by forcing quoteFlowKeys
• Additional commits viewable in compare view

Updates lint-staged from 17.0.8 to 17.5.1

Release notes

Sourced from lint-staged's releases.

v17.5.1

Patch Changes

• #1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

  A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

v17.5.0

Minor Changes

• #1847 f9063b7 - Lint-staged now refuses to run when files were staged with --intent-to-add, because Git stash doesn't support them. Previously this was an unhandled error.

Patch Changes

• #1848 d718ccc - Lint-staged now handles color support better in non-TTY streams, and honors the FORCE_COLOR environment variable.

• #1845 7e5ece8 - Update tinyexec@1.3.1 so that local binaries from node_modules/.bin are resolved starting from the directory of each lint-staged configuration file (in monorepo setups). This behavior was broken in lint-staged@16.3.0 where they were only resolved from the current working directory and up.

• #1845 eb8a4e3 - Do not try to restore untracked files when using --hide-all and there is no initial commit yet.

v17.4.1

17.4.1

Patch Changes

• #1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.

17.4.0

Minor Changes

• #1836 90ec282 - Added a new defineConfig helper for type-checking the lint-staged configuration:

  // lint-staged.config.ts
  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': ['prettier --check', 'eslint'],
  })

• #1832 510a27c - Added a new flag --all to make lint-staged include all files tracked by Git, instead of only staged.

  By default lint-staged only runs tasks on files that include staged changes (hence the name). Use this flag to include all files tracked in Git version control (standard exclusions apply). Using this flag implies the --no-stash flag, disabling the automatic backup, and the --allow-empty flag so that lint-staged doesn't fail when there are no changes after running. This makes it easier to run npx lint-staged --all on a clean state, for example in CI.

Patch Changes

• #1838 69bec99 - The behavior of the automatic backup stash has been improved when running lint-staged in multiple worktrees in parallel. You should still avoid running multiple instances of lint-staged in parallel in the same tree, because some of the Git operations are locking and might lead to data loss.

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.5.1

Patch Changes

• #1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

  A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

17.5.0

Minor Changes

• #1847 f9063b7 - Lint-staged now refuses to run when files were staged with --intent-to-add, because Git stash doesn't support them. Previously this was an unhandled error.

Patch Changes

• #1848 d718ccc - Lint-staged now handles color support better in non-TTY streams, and honors the FORCE_COLOR environment variable.

• #1845 7e5ece8 - Update tinyexec@1.3.1 so that local binaries from node_modules/.bin are resolved starting from the directory of each lint-staged configuration file (in monorepo setups). This behavior was broken in lint-staged@16.3.0 where they were only resolved from the current working directory and up.

• #1845 eb8a4e3 - Do not try to restore untracked files when using --hide-all and there is no initial commit yet.

17.4.1

Patch Changes

• #1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.

17.4.0

Minor Changes

• #1836 90ec282 - Added a new defineConfig helper for type-checking the lint-staged configuration:

  // lint-staged.config.ts
  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': ['prettier --check', 'eslint'],
  })

• #1832 510a27c - Added a new flag --all to make lint-staged include all files tracked by Git, instead of only staged.

  By default lint-staged only runs tasks on files that include staged changes (hence the name). Use this flag to include all files tracked in Git version control (standard exclusions apply). Using this flag implies the --no-stash flag, disabling the automatic backup, and the --allow-empty flag so that lint-staged doesn't fail when there are no changes after running. This makes it easier to run npx lint-staged --all on a clean state, for example in CI.

Patch Changes

... (truncated)

Commits

• f8b1ab1 Merge pull request #1853 from lint-staged/changeset-release/main
• 3b54961 chore(changeset): release
• 09317ff Merge pull request #1852 from lint-staged/fix-ambient-declaration
• bfcca94 fix: change defineConfig signature from const to a function
• dcb59f6 Merge pull request #1846 from lint-staged/changeset-release/main
• 9c8c6dc chore(changeset): release
• 586466f Merge pull request #1849 from lint-staged/improve-intent-to-add
• 45eda5f refactor: improve --intent-to-add detection
• 26372e3 Merge pull request #1848 from lint-staged/fix-color-detection
• d718ccc fix: honor FORCE_COLOR/NO_COLOR env variables in non-TTY streams
• Additional commits viewable in compare view

Updates prettier from 3.8.4 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

• Preserve quotes for methods named new (prettier/prettier#19621 by @​kovsu)
• Support import defer in typescript parser (prettier/prettier#19624, prettier/prettier#19675 by @​fisker)
• Added a new official plugin @prettier/plugin-yuku 🚀 (prettier/prettier#19628, prettier/prettier#19629 by @​fisker)

🔗 Changelog

3.9.5

🔗 Changelog

3.9.4

• Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @​seiyab)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @​evoactivity)

🔗 Changelog

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

• Fix Flow variance annotation print (#19022 by @​marcoww6)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621Description has been truncated

[pr-auditor]

✅ Security Analysis Results

No security issues found. 2 files reviewed.

---

@pr-auditor rescan to re-run · Powered by Claude Sonnet 5 · Docs · #security-engineering-team