chore(deps-dev): bump lint-staged from 15.5.0 to 16.1.0

[dependabot]

Bumps lint-staged from 15.5.0 to 16.1.0.

Release notes

Sourced from lint-staged's releases.

v16.1.0

Minor Changes

• #1536 e729daa Thanks @​iiroj! - A new flag --no-revert has been introduced for when task modifications should be applied to the index before aborting the commit in case of errors. By default, lint-staged will clear all task modifications and revert to the original state.

• #1550 b27fa3f Thanks @​iiroj! - Lint-staged now ignores symlinks and leaves them out from the list of staged files.

Patch Changes

• #1558 c37dc38 Thanks @​iiroj! - The minimum required Node.js version is lowered to 20.17 following nano-spawn@1.0.2.

v16.0.0

Major Changes

• #1546 158d15c Thanks @​iiroj! - Processes are spawned using nano-spawn instead of execa. If you are using Node.js scripts as tasks, you might need to explicitly run them with node, especially when using Windows:

  {
    "*.js": "node my-js-linter.js"
  }

• #1546 158d15c Thanks @​iiroj! - The --shell flag has been removed and lint-staged no longer supports evaluating commands directly via a shell. To migrate existing commands, you can create a shell script and invoke it instead. Lint-staged will pass matched staged files as a list of arguments, accessible via "$@":

  # my-script.sh
  #!/bin/bash
  echo "Staged files: $@"

  and

  { "*.js": "my-script.sh" }

  If you were using the shell option to avoid passing filenames to tasks, for example bash -c 'tsc --noEmit', use the function syntax instead:

  export default { '*.ts': () => 'tsc --noEmit' }

• #1546 158d15c Thanks @​iiroj! - Validation for deprecated advanced configuration has been removed. The advanced configuration was removed in lint-staged version 9 and until now validation has failed if advanced configuration options were detected. Going forward the entire configuration will be treated with the same logic and if these advanced options are still present, they might be treated as valid globs for staged files instead.

• #1546 158d15c Thanks @​iiroj! - The lowest supported Node.js version is 20.18. Please upgrade your Node.js version.

Minor Changes

• #1401 27110ef Thanks @​RohitLuthra19! - Added support for directly running functions on staged files. To configure a function task, use an object with a title and the task itself:

... (truncated)

Changelog

Sourced from lint-staged's changelog.

16.1.0

Minor Changes

• #1536 e729daa Thanks @​iiroj! - A new flag --no-revert has been introduced for when task modifications should be applied to the index before aborting the commit in case of errors. By default, lint-staged will clear all task modifications and revert to the original state.

• #1550 b27fa3f Thanks @​iiroj! - Lint-staged now ignores symlinks and leaves them out from the list of staged files.

Patch Changes

• #1558 c37dc38 Thanks @​iiroj! - The minimum required Node.js version is lowered to 20.17 following nano-spawn@1.0.2.

16.0.0

Major Changes

• #1546 158d15c Thanks @​iiroj! - Processes are spawned using nano-spawn instead of execa. If you are using Node.js scripts as tasks, you might need to explicitly run them with node, especially when using Windows:

  {
    "*.js": "node my-js-linter.js"
  }

• #1546 158d15c Thanks @​iiroj! - The --shell flag has been removed and lint-staged no longer supports evaluating commands directly via a shell. To migrate existing commands, you can create a shell script and invoke it instead. Lint-staged will pass matched staged files as a list of arguments, accessible via "$@":

  # my-script.sh
  #!/bin/bash
  echo "Staged files: $@"

  and

  { "*.js": "my-script.sh" }

  If you were using the shell option to avoid passing filenames to tasks, for example bash -c 'tsc --noEmit', use the function syntax instead:

  export default { '*.ts': () => 'tsc --noEmit' }

• #1546 158d15c Thanks @​iiroj! - Validation for deprecated advanced configuration has been removed. The advanced configuration was removed in lint-staged version 9 and until now validation has failed if advanced configuration options were detected. Going forward the entire configuration will be treated with the same logic and if these advanced options are still present, they might be treated as valid globs for staged files instead.

• #1546 158d15c Thanks @​iiroj! - The lowest supported Node.js version is 20.18. Please upgrade your Node.js version.

Minor Changes

... (truncated)

Commits

• f92caaa chore(changeset): release
• e729daa feat: add "--no-revert" flag to disable reverting to original state in case o...
• c37dc38 fix: lower minimum required Node.js version to 20.17
• 48f778f build(deps): update dependencies
• b27fa3f feat: leave out symlinks from list of staged files
• a941f2c docs: add table of contents section to README.md (#1555)
• dad5490 chore(changeset): release
• 1c19e82 build(deps): update dependencies and require Node.js 20.18
• 08cf8f5 docs: update README.md and bump nano-spawn as major change
• 276dcc8 refactor: simplify config validation
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/lint-staged	^16.1.0	Unknown	Unknown
npm/commander	14.0.0	🟢 7.3	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 10 22 commit(s) and 27 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Code-Review 🟢 9 Found 11/12 approved changesets -- score normalized to 9 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST 🟢 9 SAST tool detected but not run on all commits Vulnerabilities 🟢 10 0 existing vulnerabilities detected
npm/debug	4.4.1	🟢 4.1	Details Check Score Reason Dangerous-Workflow ⚠️ -1 no workflows found Token-Permissions ⚠️ -1 No tokens found Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review 🟢 3 Found 10/30 approved changesets -- score normalized to 3 Pinned-Dependencies ⚠️ -1 no dependencies found Maintained 🟢 5 4 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 5 Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed Vulnerabilities 🟢 10 0 existing vulnerabilities detected License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/lint-staged	16.1.0	Unknown	Unknown
npm/listr2	8.3.3	Unknown	Unknown
npm/nano-spawn	1.0.2	Unknown	Unknown
npm/yaml	2.8.0	🟢 6.5	Details Check Score Reason Maintained 🟢 10 19 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 1 Found 3/25 approved changesets -- score normalized to 1 Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 10 SAST tool is run on all commits Vulnerabilities 🟢 10 0 existing vulnerabilities detected

Scanned Files

• package.json
• pnpm-lock.yaml

[dependabot]

Superseded by #464.