Skip to content

chore(deps-dev): bump the dev-tooling group across 1 directory with 6 updates - #15

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/dev-tooling-a6f165d9ec
Open

chore(deps-dev): bump the dev-tooling group across 1 directory with 6 updates#15
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/dev-tooling-a6f165d9ec

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 25, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-tooling group with 6 updates in the / directory:

Package From To
@commitlint/cli 21.2.3 21.2.4
@commitlint/config-conventional 21.2.3 21.2.4
knip 6.38.0 6.42.1
lefthook 2.1.14 2.2.2
react-doctor 0.9.14 0.9.18
vitest 5.0.2 5.0.5

Updates @commitlint/cli from 21.2.3 to 21.2.4

Release notes

Sourced from @​commitlint/cli's releases.

v21.2.4

21.2.4 (2026-10-18)

Bug Fixes

Performance Improvements

Docs, etc

Full Changelog: conventional-changelog/commitlint@v21.2.3...v21.2.4

Changelog

Sourced from @​commitlint/cli's changelog.

21.2.4 (2026-10-18)

Note: Version bump only for package @​commitlint/cli

Commits

Updates @commitlint/config-conventional from 21.2.3 to 21.2.4

Release notes

Sourced from @​commitlint/config-conventional's releases.

v21.2.4

21.2.4 (2026-10-18)

Bug Fixes

Performance Improvements

Docs, etc

Full Changelog: conventional-changelog/commitlint@v21.2.3...v21.2.4

Changelog

Sourced from @​commitlint/config-conventional's changelog.

21.2.4 (2026-10-18)

Note: Version bump only for package @​commitlint/config-conventional

Commits

Updates knip from 6.38.0 to 6.42.1

Release notes

Sourced from knip's releases.

Release 6.42.1

  • fix(semantic-release): resolve shareable configs from extends (#2159) (4c4a5ece9148cf621f3a6e091fd3550b18f6e19a) - thanks @​giaBaoJS!
  • fix(jest): load projects entries as Jest configs (#2167) (4c22593724460890e4492ba86119d0188127f2ba) - thanks @​Cayan!
  • Update npmx.dev snapshot (4b19797b77a559f7190e9119b3a156e1ac6aef9f)
  • fix(tailwind): track packages referenced from CSS url() (#2166) (949da00abf419c1eeabdab1541ce7e5c312371b9) - thanks @​agustincastaing!
  • Add .otf to foreign file extensions (fcff4db0b88d6282569743cd779aec5a5df99862)
  • Match quoted SCSS url() values within a single line (2c5c2a2efab8f08be538bfe1f40982cb6f0fca3c)
  • fix(bun): treat bun test arguments as path filters (#2165) (5f3a7fb526d3eca7561aacfc9d0ac60056525206) - thanks @​jakeleventhal!
  • fix(vitest): use default test entries when config has no test key (#2170) (7ee576ccd461f719b533e3783a5b58391ce89e91) - thanks @​fixfon!

Release 6.42.0

  • fix: add bun 1.4.3 check subcommand (#2131) (09129b8aaa554ffae2ff8f42a5ff4d6994eb7759) - thanks @​NimmLor!
  • Detect pnpm workspaces correctly around packages: (resolve #2133, close #2134) (d1cc0928be54e6cac9668460d9f6a21e3a94f818)
  • fix(github-actions): resolve working-directory nested under checkout path (#2136) (87e051e45f12c107cc25ed08bba962b95bb23b51) - thanks @​kenny-ish!
  • fix(nx): track local generator and executor entry points (#2117) (#2121) (558407f51b5fdf4460275b69950676e7bace35d5) - thanks @​DreamLongYT!
  • Update dependency bun to v1.4.3 (#2137) (71f90bf6d5fb2675430f60416e403851f9cb2cfe) - thanks @​renovate[bot]!
  • docs(react-router): note to run react-router typegen before Knip (#2140) (f21ce9a9f1e3264cad1b763cf31ec2c177fb8656) - thanks @​MannXo!
  • fix: normalize scoped binary names (close #2143) (c8509c4e45e1c343da707c26877a0a6584f6bc11)
  • Clarify plugin implementation boundaries (c5a67f59d351e8d26dc6ecbbd3c3193e313772a4)
  • fix(jest): treat mocked and required dependencies as used (#2141) (3eaf1ba16045a3ac22f0717c4f1252312298bb76) - thanks @​TkDodo!
  • fix: preserve root-only plugins for trailing-slash cwd (#2139) (7f0db0e7670bfd18fab081b522a104f787829f7d) - thanks @​sean0407!
  • fix(nx): resolve run-commands script paths from the target cwd (#2151) (516bd9a324303653978528f582287c857846fcc8) - thanks @​JeanBeaurepaire!
  • Resolve Nx run-commands loader paths from the target cwd (fa8ca13e1345115d30122900ab68db7339487502)
  • Add @​solidjs/vite-plugin plugin (#2144) (579a88d306429694be43590efb50cb72067551ba) - thanks @​everton-dgn!
  • feat: add filesystem-routing plugin (#2145) (1abd9e1875bae36b0baf77f5864aab849d1528a8) - thanks @​everton-dgn!
  • Support tags in line comments (resolve #1924) (5abef4846e20f09fd4d0ee8dc2513ce50b616cdb)
  • Keep resolveFromAST to static values in plugin guide (4cd353fd9ecb780228a63069080586a46ba6a8f2)
  • fix(solidjs-vite-plugin): keep entry overrides in production (#2155) (e4b5f890787da07824cc174cb624396f2133ff06) - thanks @​everton-dgn!
  • feat(angular): resolve styleUrl and styleUrls of @​Component (#2157) (c20d4d720c586c9c5dc6e3d1a6ea60c557688bfa) - thanks @​Cayan!
  • Update npmx.dev snapshot (59eb873f3beecf40b7aed9579bd29e1ab8b631f0)
  • fix(next): recognize Turbopack alias targets (#2156) (1d44f6a1a39c5557c1e215c7cf9db17937967344) - thanks @​jakeleventhal!
  • fix: preserve re-exports from framework entries (#2154) (263ce20408a77b2473c555f304ad3b55c696b6a6) - thanks @​jakeleventhal!
  • feat(solidjs-vite-plugin): follow Solid's SSR and client mode entry rules (#2148) (d711231eae14d8ecac562d73078125f3b30dc8fd) - thanks @​everton-dgn!
  • feat(filesystem-routing): read route options from Vite configs (#2149) (585f206ca52d54e30f2068c818e1b33b50085459) - thanks @​everton-dgn!
  • feat(filesystem-routing): resolve routes from the Vite root (#2150) (8cc0cb0c9ff09463cad30817c8cf78cbc48b7ed6) - thanks @​everton-dgn!
  • fix: track namespace members in Promise.all imports (#2162) (3f17cdfce7a0f90e2599a7074291c4c875fe8244) - thanks @​everton-dgn!
  • Update a few dependencies (161dbed3ccffa574e3a9493ddb20842eefa26af8)
  • Fix Solid setup fixture coverage (ebe4180785667f6ff85c1e6ce2a11226713b2d5a)
  • Migrate shell script parsing to unbash v6 (f86044c6760ac4f27e564f15feeae907cba3d297)
  • Add sponsors: @​pennylane-hq, @​agentscore, @​oblique-security (thank you!) (57ff23eb430aaece73e02574923cabc6016a920b)
  • Stop pairing Promise.all imports and bindings after a spread (5bd2c64eaf92f82a316d8fa6551acdb1d6c48c32)
  • Update some stats (dd02ddeb235dd516cf93db99dda2180b0eb09a97)
  • fix(nx): read karmaConfig from target options (#2164) (4e1e4bc18f6d2f2705d729c375a20bd1679b8c0f) - thanks @​Cayan!
  • Add tsrs plugin (#2163) (ba09126c023a2c408de8d7dae3bf6ab97e420966) - thanks @​jakeleventhal!
  • Drop redundant containingFilePath from plugin config inputs (ffb6caf02891d29eee41c7a0ecf147312dbe7205)
  • Resolve Nx target option configs from the workspace root (52c5233aa905124c5b30c0bb7f9b0b25cd4260c6)

Release 6.41.0

  • Add Flue plugin (#2124) (c52737d45ff008d6d96d4c2d4182048a2aa64602) - thanks @​LuisFigueroaG!
  • Match all React Native config file extensions (#2125) (898fdffb37ae0bdb3d2653038eb10c2e01edf983) - thanks @​LuisFigueroaG!

... (truncated)

Commits
  • ee32ee6 Release knip@6.42.1
  • 7ee576c fix(vitest): use default test entries when config has no test key (#2170)
  • 5f3a7fb fix(bun): treat bun test arguments as path filters (#2165)
  • 2c5c2a2 Match quoted SCSS url() values within a single line
  • fcff4db Add .otf to foreign file extensions
  • 949da00 fix(tailwind): track packages referenced from CSS url() (#2166)
  • 4c22593 fix(jest): load projects entries as Jest configs (#2167)
  • 4c4a5ec fix(semantic-release): resolve shareable configs from extends (#2159)
  • 8aa7d0e Release knip@6.42.0
  • 52c5233 Resolve Nx target option configs from the workspace root
  • Additional commits viewable in compare view

Updates lefthook from 2.1.14 to 2.2.2

Release notes

Sourced from lefthook's releases.

v2.2.2

Changelog

  • 4aeffd72a6e3ea846c2054cffd6294c943fd7fbb fix: cleanup only current stash hash (#1597)
  • db62412c82ddac71cf536e60e50edb2826624870 packaging: add support for android (#1591)
  • e3fa81b1f01881829ef95e37211da7923a4fd6df refactor(filter): simplify mimetype matching (#1596)

v2.2.1

Changelog

  • 6dd11f61f54595935746f9e0814c16844fc6d31b feat: support php composer (#1583)
  • c702ccf154bb180107ba5f790518c161d9ce111d fix: generate different patch names when in a worktree (#1582)
  • 486fdd317d29f815821ce2450d42e3a49b066eb0 refactor: cache paths in wrapper (#1570)

v2.2.0

Changelog

  • 46c65b3871dd96c81624f413b24b3d273b41a4e5 deps: October 2026 (#1571)
  • 37f17131b605cf0f64c29252ebfe94610368f769 fix: don't write an install-time lefthook path into AI hook configs (#1544)
  • cc9969c2e2198aafff8accc63ee1aee30e9a2aa4 fix: ignore trailing NUL in --files-from-stdin (#1574)
  • 57fee374b70c18e17ada20e09a336142d6d8899f fix: pass --output path to git diff as a single argument (#1581)

v2.1.17

Changelog

  • 8d8073d427fac49cc982919f5280b295645d196d fix: diff push files against the merge base with the default branch (#1565)
  • c12bccd193f43a8419038787bd83b12fe3a4470c fix: don't hash submodules when checking fail_on_changes (#1566)
  • 03225efde40226b14459e901707fbd988d62fcc0 refactor: naming of helpers (#1568)
  • 66746ace996c72ac31b3cb4a70af85607568baf4 refactor: working with git (#1564)

v2.1.16

Changelog

  • 3ee04318fd06d56a70cc9c90dc8385b19918f520 ci: refactor publishing scripts (#1559)
  • 91407e537b2fa36539506963a33e582dca394798 deps: bump mod and text deps to resolve CVEs (#1560)
  • be6f0ae8793533449cb9a07a253fa9a381e82206 fix: preserve unrelated unstaged changes on conflict (#1483)
  • cf4ef1e19baf0581871f69b40914d64c94ff19d7 fix: test staging fixed files with partially staged

v2.1.15

Changelog

  • 2388dde2b31dc9a782e967764046b41b404cece9 feat: propagate forced colors to hook commands via CLICOLOR_FORCE (#1547)
  • 49260b57c2a56bc4d65d09395458bb3ce3c63311 fix(lfs): do not pipe stdin into post-checkout git-lfs hook (#1523)
  • 38bc1c6cef3192a36002d0dcc37973416249c07e fix: quote paths in the generated hook shim (#1509)
  • 0892f5f256ebe162485492af5ca14c2ced45586f fix: remove color blending (#1558)
  • f1de41cd5cd6a6c5e0179c65e00d5ed6d90078c2 fix: resolve push-files fallback against the remote-tracking ref (#1485)
  • 07ce565bcc73465bc18fb36561b935ee2a53eab6 fix: sanitize slashes in remote ref when building the checkout dir name (#1486)
  • c465ca8ef4fc9ee0695aa4a9530fc404ed838b7a test(cmd): regression for valid fish shell completion output (#1527)
Changelog

Sourced from lefthook's changelog.

2.2.2

2.2.1

2.2.0

2.1.7

2.1.16

2.1.15

Commits
  • eb4e504 2.2.2: keep backups for worktree flows and release android NPM package
  • 4aeffd7 fix: cleanup only current stash hash (#1597)
  • e3fa81b refactor(filter): simplify mimetype matching (#1596)
  • db62412 packaging: add support for android (#1591)
  • 60c1ddd 2.2.1: support concurrent work in worktrees and release PHP package
  • 6dd11f6 feat: support php composer (#1583)
  • c702ccf fix: generate different patch names when in a worktree (#1582)
  • 486fdd3 refactor: cache paths in wrapper (#1570)
  • 125cd28 2.2.0: new Go version and git worktree fixes
  • 37f1713 fix: don't write an install-time lefthook path into AI hook configs (#1544)
  • Additional commits viewable in compare view
Attestation changes

This version has no provenance attestation, while the previous version (2.1.14) was attested. Review the package versions before updating.


Updates react-doctor from 0.9.14 to 0.9.18

Release notes

Sourced from react-doctor's releases.

react-doctor@0.9.18

Patch Changes

  • #1386 041d1ab Thanks @​skoshx! - Record the GitHub Action clean-comment preference in anonymized scan telemetry and document the workflow input.

  • #1943 6932e7d Thanks @​aidenybai! - Match API Platform subscription IDs to the provider's resource-and-IDs unsubscribe contract.

  • #1920 0298eb8 Thanks @​aidenybai! - Do not infer React hooks from relative helper imports in Angular component classes. Continue to check React and React ecosystem imports.

  • #1926 012e208 Thanks @​aidenybai! - Do not classify a local state transition as a prop-driven adjustment when its only prop dependencies are called notifications. Keep checks for prop values used in guards, results, or reset dependencies.

  • #1911 bb00a27 Thanks @​aidenybai! - Do not recommend lazy state initialization for cheap primitive toString calls, including numeric React Native Dimensions values. Keep warnings for unproven receivers and nested expensive calls.

  • #1919 1f6b98a Thanks @​aidenybai! - Report inaccessible parent click actions when descendant handlers stop keyboard-generated clicks from reaching them.

  • #1928 a68f193 Thanks @​aidenybai! - Match listener cleanup when both branches of conditional options have the same capture value. Keep warnings for differing capture values, changed options, and missing cleanup.

    Recognize exhaustive listener-removal loops extracted into a synchronous helper when the cleanup only invokes that helper.

  • #1965 695e46e Thanks @​aidenybai! - Add the opt-in --scope contextual reporting mode. Selected rules report existing findings when their owning function, JSX element, or file changes. Other rules retain line filtering. Support deletion-only edits, staged scans, untracked files, and separate result-cache entries while preserving existing scope defaults and diagnostic locations.

  • #1933 72fab66 Thanks @​aidenybai! - Preserve count-based placeholder identity through a local array before mapping wrappers.

  • #1907 e2b047b Thanks @​aidenybai! - Preserve numeric placeholder-loop identity through local key aliases, including constant-prefix keys. Continue reporting index aliases for loops over array data.

  • #1905 a1cff2e Thanks @​aidenybai! - Keep browser reads in helpers defined inside React effects out of server-render diagnostics. Preserve warnings for render callbacks and shadowed effect functions.

  • #1924 89c6701 Thanks @​aidenybai! - Do not classify zero-argument effect notifications as state payloads sent to a parent. Continue to report callbacks that pass local state.

  • #1850 ab39ac4 Thanks @​skoshx! - Install and manage GitHub Actions workflows at the repository root when invoked from a nested package or linked worktree.

  • #1852 d53c820 Thanks @​skoshx! - Exclude .cloudflare build output directory from source file discovery. Cloudflare's cf CLI stores compiled Worker bundles and cache state there, mirroring the existing .wrangler exclusion.

  • #1964 5f322ad Thanks @​aidenybai! - Honor explicit rules settings of "warn" or "error" for ported rules when customRulesOnly is enabled. Current and legacy rule keys both work. Other ported rules and the React Compiler plugin stay disabled, and project requirements and tag exclusions still apply.

  • #1883 909b8e5 Thanks @​skoshx! - fix(effect-needs-cleanup): accept Promise timer that resets its own handle in callback

    Fixes #1882. The rule no longer flags a timer created in a Promise callback when the timer's own callback resets the handle to null or undefined. This is safe because the timer has already fired when the reset happens, so no live handle is lost.

  • #1631 f8e6ea4 Thanks @​skoshx! - Fix --staged refusing to scan in linked git worktrees when GIT_DIR is set. Clear the inherited GIT_DIR environment variable in the staged divergence check so git status resolves paths correctly, matching the fix for scoped scans in #1516.

  • #1869 7bebcfc Thanks @​aidenybai! - Use constant Boolean initializers before treating numeric-looking JSX guard names as numbers. Preserve warnings for mutable bindings, destructuring defaults, and numeric values.

  • #1873 6790398 Thanks @​aidenybai! - Require root route error boundaries only for data routers, since declarative useRoutes configurations do not use data-router error handling.

  • #1875 ad8bca6 Thanks @​aidenybai! - Recognize legacy React.createClass components so render callbacks retain their instance this instead of being treated as function components.

  • #1874 c92fec1 Thanks @​aidenybai! - Accept direct anchor children owned by an imported Next Link component, including the legacy Link child API.

  • #1872 2825dfd Thanks @​aidenybai! - Allow state updater callbacks to reassign their local parameter while still reporting writes to prior-state properties and captured values.

... (truncated)

Changelog

Sourced from react-doctor's changelog.

0.9.18

Patch Changes

  • #1386 041d1ab Thanks @​skoshx! - Record the GitHub Action clean-comment preference in anonymized scan telemetry and document the workflow input.

  • #1943 6932e7d Thanks @​aidenybai! - Match API Platform subscription IDs to the provider's resource-and-IDs unsubscribe contract.

  • #1920 0298eb8 Thanks @​aidenybai! - Do not infer React hooks from relative helper imports in Angular component classes. Continue to check React and React ecosystem imports.

  • #1926 012e208 Thanks @​aidenybai! - Do not classify a local state transition as a prop-driven adjustment when its only prop dependencies are called notifications. Keep checks for prop values used in guards, results, or reset dependencies.

  • #1911 bb00a27 Thanks @​aidenybai! - Do not recommend lazy state initialization for cheap primitive toString calls, including numeric React Native Dimensions values. Keep warnings for unproven receivers and nested expensive calls.

  • #1919 1f6b98a Thanks @​aidenybai! - Report inaccessible parent click actions when descendant handlers stop keyboard-generated clicks from reaching them.

  • #1928 a68f193 Thanks @​aidenybai! - Match listener cleanup when both branches of conditional options have the same capture value. Keep warnings for differing capture values, changed options, and missing cleanup.

    Recognize exhaustive listener-removal loops extracted into a synchronous helper when the cleanup only invokes that helper.

  • #1965 695e46e Thanks @​aidenybai! - Add the opt-in --scope contextual reporting mode. Selected rules report existing findings when their owning function, JSX element, or file changes. Other rules retain line filtering. Support deletion-only edits, staged scans, untracked files, and separate result-cache entries while preserving existing scope defaults and diagnostic locations.

  • #1933 72fab66 Thanks @​aidenybai! - Preserve count-based placeholder identity through a local array before mapping wrappers.

  • #1907 e2b047b Thanks @​aidenybai! - Preserve numeric placeholder-loop identity through local key aliases, including constant-prefix keys. Continue reporting index aliases for loops over array data.

  • #1905 a1cff2e Thanks @​aidenybai! - Keep browser reads in helpers defined inside React effects out of server-render diagnostics. Preserve warnings for render callbacks and shadowed effect functions.

  • #1924 89c6701 Thanks @​aidenybai! - Do not classify zero-argument effect notifications as state payloads sent to a parent. Continue to report callbacks that pass local state.

  • #1850 ab39ac4 Thanks @​skoshx! - Install and manage GitHub Actions workflows at the repository root when invoked from a nested package or linked worktree.

  • #1852 d53c820 Thanks @​skoshx! - Exclude .cloudflare build output directory from source file discovery. Cloudflare's cf CLI stores compiled Worker bundles and cache state there, mirroring the existing .wrangler exclusion.

  • #1964 5f322ad Thanks @​aidenybai! - Honor explicit rules settings of "warn" or "error" for ported rules when customRulesOnly is enabled. Current and legacy rule keys both work. Other ported rules and the React Compiler plugin stay disabled, and project requirements and tag exclusions still apply.

  • #1883 909b8e5 Thanks @​skoshx! - fix(effect-needs-cleanup): accept Promise timer that resets its own handle in callback

    Fixes #1882. The rule no longer flags a timer created in a Promise callback when the timer's own callback resets the handle to null or undefined. This is safe because the timer has already fired when the reset happens, so no live handle is lost.

  • #1631 f8e6ea4 Thanks @​skoshx! - Fix --staged refusing to scan in linked git worktrees when GIT_DIR is set. Clear the inherited GIT_DIR environment variable in the staged divergence check so git status resolves paths correctly, matching the fix for scoped scans in #1516.

  • #1869 7bebcfc Thanks @​aidenybai! - Use constant Boolean initializers before treating numeric-looking JSX guard names as numbers. Preserve warnings for mutable bindings, destructuring defaults, and numeric values.

  • #1873 6790398 Thanks @​aidenybai! - Require root route error boundaries only for data routers, since declarative useRoutes configurations do not use data-router error handling.

  • #1875 ad8bca6 Thanks @​aidenybai! - Recognize legacy React.createClass components so render callbacks retain their instance this instead of being treated as function components.

  • #1874 c92fec1 Thanks @​aidenybai! - Accept direct anchor children owned by an imported Next Link component, including the legacy Link child API.

... (truncated)

Commits
  • d1feed1 chore: version packages (#1881)
  • 695e46e feat: add contextual diff scope (#1965)
  • 5f322ad fix: honor explicit rules with customRulesOnly (#1964)
  • e5824ab docs: keep README focused on getting started (#1953)
  • 066a7c7 test: wait for stdin probe readiness on slow runners (#1914)
  • 6ff6710 feat(cli): add a separate exit code for warnings (#1900)
  • a3cbae0 fix: tighten observer cleanup and matcher render detection (#1898)
  • 673ce80 Merge branch 'codex/prepare-skoshx-1848' into codex/merge-selected-fixes
  • 5bd2539 test(action): normalize Windows line endings in workflow checks
  • cf29f73 fix(action): use installed project commands and preserve version overrides
  • Additional commits viewable in compare view

Updates vitest from 5.0.2 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub

v5.0.4

   🚀 Features

mtakhirov and others added 2 commits October 17, 2026 14:12
@mtakhirov @claude
fix(security): remove injected malware payload
51d1a67 
An attacker rewrote earlier commits (committer davidvicos1) and hid an
obfuscated loader after long whitespace in build config files. The loader
resolves a C2 address from Ethereum transactions and runs a remote script
via node. Remove the payload and the injected createRequire lines.

Files: apps/web/postcss.config.mjs, packages/ui/postcss.config.mjs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@dependabot
chore(deps-dev): bump the dev-tooling group across 1 directory with 6…
d8bf4f2 
… updates
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 25, 2026
@mtakhirov
mtakhirov force-pushed the dependabot/npm_and_yarn/dev-tooling-a6f165d9ec branch from 8f9509d to d8bf4f2 Compare October 26, 2026 20:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mtakhirov