chore(deps): update devdependency lint-staged to v15

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
lint-staged	^13.0.3 -> ^15.2.10

---

Release Notes

lint-staged/lint-staged (lint-staged)

v15.2.10

Compare Source

Patch Changes

• #​1471 e3f283b Thanks @​iiroj! - Update minor dependencies, including micromatch@~4.0.8.

v15.2.9

Compare Source

Patch Changes

• #​1463 b69ce2d Thanks @​iiroj! - Set the maximum number of event listeners to the number of tasks. This should silence the console warning MaxListenersExceededWarning: Possible EventEmitter memory leak detected.

v15.2.8

Compare Source

Patch Changes

• f0480f0 Thanks @​iiroj! - In the previous version the native git rev-parse --show-toplevel command was taken into use for resolving the current git repo root. This version switched the --show-toplevel flag with --show-cdup, because on Git installed via MSYS2 the former was returning absolute paths that do not work with Node.js child_process. The new flag returns a path relative to the working directory, avoiding the issue.

  The GitHub Actions workflow has been updated to install Git via MSYS2, to ensure better future compatibility; using the default Git binary in the GitHub Actions runner was working correctly even with MSYS2.

v15.2.7

Compare Source

Patch Changes

• #​1440 a51be80 Thanks @​iiroj! - In the previous version the native git rev-parse --show-toplevel command was taken into use for resolving the current git repo root. This version drops the --path-format=absolute option to support earlier git versions since it's also the default behavior. If you are still having trouble, please try upgrading git to the latest version.

v15.2.6

Compare Source

Patch Changes

• #​1433 119adb2 Thanks @​iiroj! - Use native "git rev-parse" commands to determine git repo root directory and the .git config directory, instead of using custom logic. This hopefully makes path resolution more robust on non-POSIX systems.

v15.2.5

Compare Source

Patch Changes

• #​1424 31a1f95 Thanks @​iiroj! - Allow approximately equivalent versions of direct dependencies by using the "~" character in the version ranges. This means a more recent patch version of a dependency is allowed if available.

• #​1423 91abea0 Thanks @​iiroj! - Improve error logging when failing to read or parse a configuration file

• #​1424 ee43f15 Thanks @​iiroj! - Upgrade micromatch@4.0.7

v15.2.4

Compare Source

Patch Changes

• 4f4537a Thanks @​iiroj! - Fix release issue with previous version; update dependencies

v15.2.2

Compare Source

Patch Changes

• #​1391 fdcdad4 Thanks @​iiroj! - Lint-staged no longer tries to load configuration from files that are not checked out. This might happen when using sparse-checkout.

v15.2.1

Compare Source

Patch Changes

• #​1387 e4023f6 Thanks @​iiroj! - Ignore stdin of spawned commands so that they don't get stuck waiting. Until now, lint-staged has used the default settings to spawn linter commands. This means the stdin of the spawned commands has accepted input, and essentially gotten stuck waiting. Now the stdin is ignored and commands will no longer get stuck. If you relied on this behavior, please open a new issue and describe how; the behavior has not been intended.

v15.2.0

Compare Source

Minor Changes

• #​1371 f3378be Thanks @​iiroj! - Using the --no-stash flag no longer discards all unstaged changes to partially staged files, which resulted in inadvertent data loss. This fix is available with a new flag --no-hide-partially-staged that is automatically enabled when --no-stash is used.

Patch Changes

• #​1362 17bc480 Thanks @​antonk52! - update lilconfig@3.0.0

• #​1368 7c55ca9 Thanks @​iiroj! - Update most dependencies

• #​1368 777d4e9 Thanks @​iiroj! - To improve performance, only use lilconfig when searching for config files outside the git repo. In the regular case, lint-staged finds the config files from the Git index and loads them directly.

• #​1373 85eb0dd Thanks @​iiroj! - When determining git directory, use fs.realpath() only for symlinks. It looks like fs.realpath() changes some Windows mapped network filepaths unexpectedly, causing issues.

v15.1.0

Compare Source

Minor Changes

• #​1344 0423311 Thanks @​danielbayley! - Add support for loading configuration from package.yaml and package.yml files, supported by pnpm.

Patch Changes

• #​1355 105d901 Thanks @​iiroj! - Suppress some warnings when using the "--quiet" flag

v15.0.2

Compare Source

Patch Changes

• #​1339 8e82364 Thanks @​iiroj! - Update dependencies, including listr2@​7.0.2 to fix an upstream issue affecting lint-staged.

v15.0.1

Compare Source

Patch Changes

• #​1217 d2e6f8b Thanks @​louneskmt! - Previously it was possible for a function task to mutate the list of staged files passed to the function, and accidentally affect the generation of other tasks. This is now fixed by passing a copy of the original file list instead.

v15.0.0

Compare Source

Major Changes

• #​1322 66b93aa Thanks @​iiroj! - Require at least Node.js 18.12.0

  This release drops support for Node.js 16, which is EOL after 2023-09-11.
  Please upgrade your Node.js to the latest version.

  Additionally, all dependencies have been updated to their latest versions.

v14.0.1

Compare Source

Bug Fixes

• fix reading config from stdin, introduced in v14.0.0 (#​1317) (fc3bfea)

v14.0.0

Compare Source

Features

• drop support for Node.js 14 (#​1312) (9da8777)

BREAKING CHANGES

• Please upgrade your Node.js version to at least 16.14.0.

v13.3.0

Compare Source

Bug Fixes

• dependencies: update most dependencies (7443870)
• detect duplicate redundant braces in pattern (d895aa8)

Features

• dependencies: update listr2@​6.6.0 (09844ca)

v13.2.3

Compare Source

Bug Fixes

• the --diff option implies --no-stash (66a716d)

v13.2.2

Compare Source

Bug Fixes

• dependencies: update yaml@2.2.2 (GHSA-f9xv-q969-pqx4) (#​1290) (cf691aa)

v13.2.1

Compare Source

Bug Fixes

• ignore "package.json" as config file when it's invalid JSON (#​1281) (e7ed6f7)

v13.2.0

Compare Source

Bug Fixes

• dependencies: replace colorette with chalk for better color support detection (f598725)
• use index-based stash references for improved MSYS2 compatibility (#​1270) (60fcd99)

Features

• version bump only (#​1275) (05fb382)

v13.1.4

Compare Source

v13.1.3

Compare Source

v13.1.2

Compare Source

Bug Fixes

• disable stash by default when using diff option (#​1259) (142c6f2)

v13.1.1

Compare Source

Bug Fixes

• allow re-enabling --stash when using the --diff option (99390c3)

v13.1.0

Compare Source

Features

• expose cli entrance from "lint-staged/bin" (#​1237) (eabf1d2)

v13.0.4

Compare Source

Bug Fixes

• deps: update all dependencies (336f3b5)
• deps: update all dependencies (ec995e5)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@nuxtjs/eslint-config-typescript@12.0.0	Transitive: environment, eval, filesystem, unsafe	+170	20 MB	antfu
npm/@release-it/conventional-changelog@7.0.0	filesystem Transitive: environment, shell	+105	4.53 MB	webpro
npm/@types/node@18.7.2	None	0	1.74 MB	types
npm/c8@8.0.0	filesystem, unsafe Transitive: environment, shell	+26	953 kB	oss-bot
npm/eslint-config-prettier@8.5.0	None	0	18.2 kB	lydell
npm/eslint@8.23.0	filesystem Transitive: environment, eval, shell, unsafe	+90	9.51 MB	eslintbot
npm/husky@8.0.1	environment, filesystem, shell	0	6.38 kB	typicode
npm/lint-staged@15.2.10	Transitive: environment, filesystem, shell	+33	1.3 MB	okonet
npm/nuxt@3.0.0-rc.8	environment, filesystem Transitive: eval, network, shell, unsafe	+360	42.4 MB	pi0
npm/pathe@1.0.0	None	0	22.9 kB	pi0
npm/prettier@2.7.1	environment, filesystem, unsafe	0	15.8 MB	prettier-bot
npm/release-it@15.4.0	Transitive: environment, eval, filesystem, network, shell, unsafe	+247	21.9 MB	webpro

🚮 Removed packages: npm/@nuxtjs/eslint-config-typescript@12.1.0), npm/@release-it/conventional-changelog@7.0.2), npm/c8@8.0.1), npm/eslint-config-prettier@8.10.0), npm/eslint@8.57.0), npm/husky@8.0.3), npm/lint-staged@13.3.0), npm/prettier@2.8.8), npm/release-it@15.11.0), npm/typescript@5.5.4), npm/vitest@0.22.1), npm/vue@3.4.38)

View full report↗︎

[coderabbitai]

Walkthrough

The update involves changing the version of the lint-staged package in the package.json file from ^15.2.9 to ^15.2.10. This upgrade signifies a transition to a more recent version, likely offering enhancements, bug fixes, or new features. Such updates are essential for maintaining code quality and ensuring compatibility with evolving development practices.

Changes

File	Change Summary
package.json	Updated lint-staged from ^15.2.9 to ^15.2.10

Poem

In the garden, changes bloom,
A package version sheds its gloom.
From nine to ten, a leap we take,
With lint-staged, our code's awake! 🌼
Hops of joy, improvements near,
In every line, we cheer and cheer! 🐇✨

---

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

Share

• X
• Mastodon
• Reddit
• LinkedIn

Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>.
  • Generate unit testing code for this file.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai generate unit testing code for this file.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai generate interesting stats about this repository and render them as a table.
  • @coderabbitai show all the console.log statements in this repository.
  • @coderabbitai read src/utils.ts and generate unit testing code.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[socket-security]

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	Source	CI
Critical CVE	npm/parse-url@7.0.2	CVE: GHSA-j9fq-vwqv-2fm2 Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url (CRITICAL) Affected versions: < 8.1.0 Patched version: 8.1.0	package.json pnpm-lock.yaml	⚠︎

View full report↗︎

Next steps

What is a critical CVE?

Contains a Critical Common Vulnerability and Exposure (CVE).

Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore npm/parse-url@7.0.2

[coderabbitai]

Actionable comments posted: 0

Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

Commits

Files that changed from the base of the PR and between d68e65e and abba145.

Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing (1)

• package.json (1 hunks)

Files skipped from review due to trivial changes (1)

• package.json

[coderabbitai]

Actionable comments posted: 0

Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

Commits

Files that changed from the base of the PR and between abba145 and 20353e1.

Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing (1)

• package.json (1 hunks)

Additional comments not posted (1)

package.json (1)

69-69: Version update approved for lint-staged.

The update from ^13.0.3 to ^15.2.10 is correctly reflected in the package.json. This change aligns with the PR's objectives to leverage the latest enhancements and fixes in lint-staged, including better memory management and error logging.

Ensure that all dependencies and scripts that might interact with lint-staged are compatible with this new version. Given the requirement for Node.js version 18.12.0 or higher, it's good to see that this is specified under the volta section, ensuring the correct runtime environment.