Skip to content

chore: bump the dev-dependencies group with 8 updates#120

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-f08472e893
Open

chore: bump the dev-dependencies group with 8 updates#120
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-f08472e893

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 18, 2026

Bumps the dev-dependencies group with 8 updates:

Package From To
@commitlint/cli 19.8.1 21.0.1
@commitlint/config-conventional 19.8.1 21.0.1
@types/node 22.19.19 25.8.0
c8 9.1.0 11.0.0
husky 8.0.3 9.1.7
sinon 17.0.1 22.0.0
tsx 4.21.0 4.22.1
typescript 5.9.3 6.0.3

Updates @commitlint/cli from 19.8.1 to 21.0.1

Release notes

Sourced from @​commitlint/cli's releases.

v21.0.1

21.0.1 (2026-05-12)

Bug Fixes

CI

New Contributors

Full Changelog: conventional-changelog/commitlint@v21.0.0...v21.0.1

v21.0.0

Heads-up: --legacy-output is a transitional escape hatch. It will be removed in a future major release. Plan to migrate your parsers / snapshots to the new format during the v21 lifecycle.

21.0.0 (2026-05-08)

Breaking

Fixes

Internals (Node 22 cleanup)

  • chore: replace dependencies with Node 22 built-ins by @​escapedcat in #4681 — drops glob, fast-glob, import-meta-resolve, minimist, fs-extra
  • refactor: replace read-pkg with native fs.readFile + JSON.parse by @​escapedcat in #4742
  • chore: update dependency yargs to v18 by @​escapedcat in #4686
  • chore: remove cross-env, move env vars to vitest config by @​escapedcat in #4684

Dependency updates

... (truncated)

Changelog

Sourced from @​commitlint/cli's changelog.

21.0.1 (2026-05-12)

Note: Version bump only for package @​commitlint/cli

21.0.0 (2026-05-08)

BREAKING CHANGES

  • drop node v18 and v20 support
  • Bump engines to >=v22 in all 39 package.json files
  • Update @​types/node to ^22.0.0
  • Update CI matrix to [22, 24]
  • Update Ubuntu baseline job to ubuntu:26.04
  • Update Dockerfile.ci, .mise.toml, .codesandbox/ci.json
  • Update pre-commit hook to use --ignore-engines
  • Update README and docs

Co-authored-by: Claude Opus 4.6 (1M context) noreply@anthropic.com

20.5.3 (2026-04-30)

Note: Version bump only for package @​commitlint/cli

20.5.2 (2026-04-25)

Note: Version bump only for package @​commitlint/cli

20.5.0 (2026-03-15)

... (truncated)

Commits

Updates @commitlint/config-conventional from 19.8.1 to 21.0.1

Release notes

Sourced from @​commitlint/config-conventional's releases.

v21.0.1

21.0.1 (2026-05-12)

Bug Fixes

CI

New Contributors

Full Changelog: conventional-changelog/commitlint@v21.0.0...v21.0.1

v21.0.0

Heads-up: --legacy-output is a transitional escape hatch. It will be removed in a future major release. Plan to migrate your parsers / snapshots to the new format during the v21 lifecycle.

21.0.0 (2026-05-08)

Breaking

Fixes

Internals (Node 22 cleanup)

  • chore: replace dependencies with Node 22 built-ins by @​escapedcat in #4681 — drops glob, fast-glob, import-meta-resolve, minimist, fs-extra
  • refactor: replace read-pkg with native fs.readFile + JSON.parse by @​escapedcat in #4742
  • chore: update dependency yargs to v18 by @​escapedcat in #4686
  • chore: remove cross-env, move env vars to vitest config by @​escapedcat in #4684

Dependency updates

... (truncated)

Changelog

Sourced from @​commitlint/config-conventional's changelog.

21.0.1 (2026-05-12)

Note: Version bump only for package @​commitlint/config-conventional

21.0.0 (2026-05-08)

BREAKING CHANGES

  • drop node v18 and v20 support
  • Bump engines to >=v22 in all 39 package.json files
  • Update @​types/node to ^22.0.0
  • Update CI matrix to [22, 24]
  • Update Ubuntu baseline job to ubuntu:26.04
  • Update Dockerfile.ci, .mise.toml, .codesandbox/ci.json
  • Update pre-commit hook to use --ignore-engines
  • Update README and docs

Co-authored-by: Claude Opus 4.6 (1M context) noreply@anthropic.com

20.5.3 (2026-04-30)

Note: Version bump only for package @​commitlint/config-conventional

20.5.0 (2026-03-15)

Note: Version bump only for package @​commitlint/config-conventional

20.4.4 (2026-03-12)

... (truncated)

Commits

Updates @types/node from 22.19.19 to 25.8.0

Commits

Updates c8 from 9.1.0 to 11.0.0

Release notes

Sourced from c8's releases.

v11.0.0

11.0.0 (2026-02-22)

⚠ BREAKING CHANGES

  • deps: transitive deps require 20 || >=22

Bug Fixes

v10.1.3

10.1.3 (2024-12-10)

Bug Fixes

  • deps: update bcoe/v8-coverage addressing v8 issue (#552) (b32a563)

v10.1.2

10.1.2 (2024-06-13)

Bug Fixes

  • deps: make monocart-coverage-reports an optional with meta defined (3b91fda)

v10.1.1

10.1.1 (2024-06-11)

Bug Fixes

  • stop installing monocart-coverage-reports (#535) (13979a7)

v10.1.0

10.1.0 (2024-06-11)

Features

v10.0.0

10.0.0 (2024-06-10)

⚠ BREAKING CHANGES

... (truncated)

Changelog

Sourced from c8's changelog.

11.0.0 (2026-02-22)

⚠ BREAKING CHANGES

  • deps: transitive deps require 20 || >=22

Bug Fixes

10.1.3 (2024-12-10)

Bug Fixes

  • deps: update bcoe/v8-coverage addressing v8 issue (#552) (b32a563)

10.1.2 (2024-06-13)

Bug Fixes

  • deps: make monocart-coverage-reports an optional with meta defined (3b91fda)

10.1.1 (2024-06-11)

Bug Fixes

  • stop installing monocart-coverage-reports (#535) (13979a7)

10.1.0 (2024-06-11)

Features

10.0.0 (2024-06-10)

⚠ BREAKING CHANGES

  • deps: Node 18 is now the minimum supported Node.js version

Bug Fixes

  • deps: update test-exclude with new glob / minimatch (#531) (e33cf30)
Commits

Updates husky from 8.0.3 to 9.1.7

Release notes

Sourced from husky's releases.

v9.1.7

What's Changed

New Contributors

Full Changelog: typicode/husky@v9.1.6...v9.1.7

v9.1.6

What's Changed

New Contributors

Full Changelog: typicode/husky@v9.1.5...v9.1.6

v9.1.5

What's Changed

New Contributors

Full Changelog: typicode/husky@v9.1.4...v9.1.5

v9.1.4

  • Improve deprecation notice

v9.1.3

  • fix: better handle space in PATH

v9.1.2

Show a message instead of automatically removing deprecated code.

This only concerns projects that still have the following code in their hooks:

- #!/usr/bin/env sh # <- This is deprecated, remove it
- . "$(dirname -- "$0")/_/husky.sh"  # <- This is deprecated, remove it
Rest of your hook code

Hooks with these lines will fail in v10.0.0

v9.1.1

... (truncated)

Commits

Updates sinon from 17.0.1 to 22.0.0

Changelog

Sourced from sinon's changelog.

22.0.0

  • ed911df5 Update Ruby gems (Carl-Erik Kopseng)
  • 75a1e5b8 Update to Node 26 (Carl-Erik Kopseng)
  • 197d6608 Update documentation on faking timers to reflect the current state of fake-timers (Carl-Erik Kopseng)
  • c5ddf80b Update fake-timers@15.4: includes new Temporal API (Carl-Erik Kopseng)
  • f4ab02f6 Update updatable packages (Carl-Erik Kopseng)
  • 0536afc8 Quality: Global mutable call id can grow unbounded across long-lived processes (#2691) (tuanaiseo)
    • refactor: global mutable call id can grow unbounded across l

    callId is module-scoped and incremented on every invocation. In long-running test runners or embedded usage, this can grow indefinitely and eventually lose integer precision semantics for strict ordering comparisons.

    Affected files: proxy-invoke.js

    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com

    • Wrap around for all values that are too high

    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com

  • f4f7d93b Perform additional cleanup when calling callThrough() (#2670) (Cyrille)
  • 6199e9e4 improve GitHubworkflows by introducing zizmor for monitoring (#2686) (Till!)
    • fix(workflows): fetch-depth is for actions/checkout
    • chore(workflows): update
    • pin all actions to precise commits
    • avoid credential leakage from actions/checkout
    • group action updates going forward
    • add zimor config to ignore "secrets outside env"
    • add job to keep validating workflows
  • f7476b59 Use path.normalize() for path normalization (Carl-Erik Kopseng)
  • 2c975393 fix: make build and node test scripts cross-platform (laplace young)
  • a7692917 fix: isolate walk state from Object prototype (laplace young)
  • 66df977a Fix sinon.restore() cascade-restoring sub-sandboxes (#2704) (Charlie Leitheiser)

    The ESM port of createApi (#2683, shipped in 21.1.0) replaced createSandbox: createSandbox with a wrapper that pushes every newly-created sandbox into the root sandbox's fake collection:

... (truncated)

Commits
  • 52555af 22.0.0
  • ed911df Update Ruby gems
  • 75a1e5b Update to Node 26
  • 197d660 Update documentation on faking timers to reflect the current state of fake-ti...
  • c5ddf80 Update fake-timers@15.4: includes new Temporal API
  • f4ab02f Update updatable packages
  • 0536afc Quality: Global mutable call id can grow unbounded across long-lived processe...
  • f4f7d93 Perform additional cleanup when calling callThrough() (#2670)
  • 6199e9e improve GitHubworkflows by introducing zizmor for monitoring (#2686)
  • 1519009 Merge #2703: isolate walk state from Object prototype
  • Additional commits viewable in compare view

Updates tsx from 4.21.0 to 4.22.1

Release notes

Sourced from tsx's releases.

v4.22.1

4.22.1 (2026-05-17)

Bug Fixes

  • resolve tsconfig path aliases containing a colon (#780) (6979f28)

This release is also available on:

v4.22.0

4.22.0 (2026-05-14)

Features


This release is also available on:

v4.21.1

4.21.1 (2026-05-14)

Bug Fixes

  • support Node 20.11/21.2 import.meta paths (acf3d8f)
  • support Node.js 24.15.0 (c1d2d45)
  • support Node.js 26.1.0 and 25.9.0 (1d7e528)

This release is also available on:

Commits
  • 6979f28 fix: resolve tsconfig path aliases containing a colon (#780)
  • b29f6ee feat: upgrade esbuild to 0.28 (#789)
  • 0dd17e9 test: cover registerHooks loader composition
  • acf3d8f fix: support Node 20.11/21.2 import.meta paths
  • 4bbef80 test: cover configDir paths without baseUrl
  • dddc5ce test: cover sync-hook watch reruns and cleanup retries
  • 09e8f8c test: assert CLI runs without warnings
  • 1d7e528 fix: support Node.js 26.1.0 and 25.9.0
  • c1d2d45 fix: support Node.js 24.15.0
  • d04672d test: update node version feature gates
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tsx since your current version.


Updates typescript from 5.9.3 to 6.0.3

Release notes

Sourced from typescript's releases.

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0 Beta

For release notes, check out the release announcement.

Downloads are available on:

Commits
  • 050880c Bump version to 6.0.3 and LKG
  • eeae9dd 🤖 Pick PR #63401 (Also check package name validity in...) into release-6.0 (#...
  • ad1c695 🤖 Pick PR #63368 (Harden ATA package name filtering) into release-6.0 (#63372)
  • 0725fb4 🤖 Pick PR #63310 (Mark class property initializers as...) into release-6.0 (#...
  • 607a22a Bump version to 6.0.2 and LKG
  • 9e72ab7 🤖 Pick PR #63239 (Fix missing lib files in reused pro...) into release-6.0 (#...
  • 35ff23d 🤖 Pick PR #63163 (Port anyFunctionType subtype fix an...) into release-6.0 (#...
  • e175b69 Bump version to 6.0.1-rc and LKG
  • af4caac Update LKG
  • 8efd7e8 Merge remote-tracking branch 'origin/main' into release-6.0
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the dev-dependencies group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [@commitlint/cli](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/cli) | `19.8.1` | `21.0.1` |
| [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) | `19.8.1` | `21.0.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.19.19` | `25.8.0` |
| [c8](https://github.com/bcoe/c8) | `9.1.0` | `11.0.0` |
| [husky](https://github.com/typicode/husky) | `8.0.3` | `9.1.7` |
| [sinon](https://github.com/sinonjs/sinon) | `17.0.1` | `22.0.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.21.0` | `4.22.1` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.3` |


Updates `@commitlint/cli` from 19.8.1 to 21.0.1
- [Release notes](https://github.com/conventional-changelog/commitlint/releases)
- [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/cli/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.0.1/@commitlint/cli)

Updates `@commitlint/config-conventional` from 19.8.1 to 21.0.1
- [Release notes](https://github.com/conventional-changelog/commitlint/releases)
- [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.0.1/@commitlint/config-conventional)

Updates `@types/node` from 22.19.19 to 25.8.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `c8` from 9.1.0 to 11.0.0
- [Release notes](https://github.com/bcoe/c8/releases)
- [Changelog](https://github.com/bcoe/c8/blob/main/CHANGELOG.md)
- [Commits](bcoe/c8@v9.1.0...v11.0.0)

Updates `husky` from 8.0.3 to 9.1.7
- [Release notes](https://github.com/typicode/husky/releases)
- [Commits](typicode/husky@v8.0.3...v9.1.7)

Updates `sinon` from 17.0.1 to 22.0.0
- [Release notes](https://github.com/sinonjs/sinon/releases)
- [Changelog](https://github.com/sinonjs/sinon/blob/main/docs/changelog.md)
- [Commits](sinonjs/sinon@v17.0.1...v22.0.0)

Updates `tsx` from 4.21.0 to 4.22.1
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.21.0...v4.22.1)

Updates `typescript` from 5.9.3 to 6.0.3
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v6.0.3)

---
updated-dependencies:
- dependency-name: "@commitlint/cli"
  dependency-version: 21.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: "@commitlint/config-conventional"
  dependency-version: 21.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: "@types/node"
  dependency-version: 25.8.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: c8
  dependency-version: 11.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: husky
  dependency-version: 9.1.7
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: sinon
  dependency-version: 22.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: tsx
  dependency-version: 4.22.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: typescript
  dependency-version: 6.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels May 18, 2026
@socket-security
Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedhusky@​8.0.3 ⏵ 9.1.7100 +110062 -1780100
Updated@​commitlint/​cli@​19.8.1 ⏵ 21.0.19910073 +197100
Updated@​types/​node@​22.19.19 ⏵ 25.8.01001008196100
Updatedtsx@​4.21.0 ⏵ 4.22.1100 +110082 +193100
Updatedc8@​9.1.0 ⏵ 11.0.099100100 +183100
Updatedtypescript@​5.9.3 ⏵ 6.0.3100 +110090 +19690
Updatedsinon@​17.0.1 ⏵ 22.0.095 -41009896 +3100
Updated@​commitlint/​config-conventional@​19.8.1 ⏵ 21.0.110010010096100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants