devdeps(global): update dev dependencies

[mapcolonies-devops]

This PR contains the following updates:

Package	Change	Age	Confidence
@commitlint/cli (source)	20.3.1 → 20.4.1
@commitlint/config-pnpm-scopes (source)	20.1.0 → 20.4.0
commitlint (source)	20.3.1 → 20.4.1
knip (source)	5.82.1 → 5.83.0
turbo (source)	2.7.5 → 2.8.2

---

Release Notes

conventional-changelog/commitlint (@​commitlint/cli)

v20.4.1

Compare Source

Note: Version bump only for package @​commitlint/cli

v20.4.0

Compare Source

Features

• upgrade conventional commit packages #​4082 (#​4597) (3aaf0a6)

20.3.1 (2026-01-08)

Note: Version bump only for package @​commitlint/cli

conventional-changelog/commitlint (@​commitlint/config-pnpm-scopes)

v20.4.0

Compare Source

Note: Version bump only for package @​commitlint/config-pnpm-scopes

conventional-changelog/commitlint (commitlint)

v20.4.1

Compare Source

Note: Version bump only for package commitlint

v20.4.0

Compare Source

Note: Version bump only for package commitlint

20.3.1 (2026-01-08)

Note: Version bump only for package commitlint

webpro-nl/knip (knip)

v5.83.0: Release 5.83.0

Compare Source

• fix: skip empty string entries in package.json exports (#​1477) (6b64ac5) - thanks @​SBoudrias!
• add LS version to serverInfo (#​1468) (2c28cb8) - thanks @​niklas-wortmann!
• Avoid highlighting path-like specifiers (#​1488) (c8fec09) - thanks @​azat-io!
• Update avatar URLs (#​1489) (d612ac2) - thanks @​azat-io!
• Copy fix-fixtures to tmp dir (bd1519c)
• Don't add excluded issue types (resolve #​1486) (4eeeec6)
• Minor refactor (767b2c5)
• Edit docs (78111c9)
• feat: add plugin for expressive-code (#​1493) (fbf958a) - thanks @​cylewaitforit!
• Truncate file path left-side (resolves #​1494) (235949c)
• Revert fix-fixture format test (fails in outside cwd) (8e96125)
• Skip empty manifest entries (resolve #​1497) (d314ce4)
• Filter out empty issue objects in compact reporter (resolve #​1482) (7df0b4d)
• Lint/group import statements (61e7a24)
• Update AGENTS.md & docs (7537f8a)
• Optimize relative path helper (ac8a454)
• Move postinstall script to non-production (360110b)
• Ignore simple-git-hooks in production (like husky etc) (bbab35b)
• Move & add testimonials (5ab1813)
• Update sponsors page (4534a55)
• Edit docs, add config hints page (1a73a05)
• Rename reporter to match project style (58f8c4e)
• Auto-format (854124f)
• Refactor fs helper to match project style (f22e7e9)

vercel/turborepo (turbo)

v2.8.2: Turborepo v2.8.2

Compare Source

What's Changed

Docs

• fix: Upgrade next to fix HTTP deserialization DoS by @​anthonyshew in #​11597
• fix: Upgrade mermaid to fix lodash-es vulnerability by @​anthonyshew in #​11611
• fix: Upgrade recharts to fix lodash vulnerability by @​anthonyshew in #​11606
• chore: Move applications to apps/ directory by @​anthonyshew in #​11613
• fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability by @​anthonyshew in #​11616

create-turbo

• fix: Upgrade tsup to fix rollup and glob vulnerabilities by @​anthonyshew in #​11601
• fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability by @​anthonyshew in #​11622
• fix: Upgrade ts-jest to 29.4.6 to fix brace-expansion ReDoS vulnerabilities by @​anthonyshew in #​11623
• feat: Migrate from tsup to tsdown by @​anthonyshew in #​11649

@​turbo/codemod

• fix: Upgrade axios to fix SSRF vulnerability by @​anthonyshew in #​11599
• fix: Replace axios with native fetch in turbo-codemod by @​anthonyshew in #​11600
• fix: Upgrade diff to fix DoS vulnerabilities by @​anthonyshew in #​11621

eslint

• fix: Upgrade eslint devDependency to fix stack overflow vulnerability by @​anthonyshew in #​11610
• fix: Upgrade esbuild to fix arbitrary request vulnerability by @​anthonyshew in #​11615

Examples

• examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @​i5d6 in #​11591
• fix: escaping for link titles in LinksService by @​odaysec in #​11632

Changelog

• fix: Add allowComments and allowTrailingCommas to turbo.json schema by @​ddmoney420 in #​11579
• chore: Eliminate ts-rs serde attribute parse warnings by @​anthonyshew in #​11589
• fix: Extract git argument validation into reusable helper by @​anthonyshew in #​11593
• fix: Upgrade fast-xml-parser to fix RangeError DoS by @​anthonyshew in #​11598
• fix: Upgrade semver to fix ReDoS vulnerability by @​anthonyshew in #​11596
• fix: Upgrade tar to fix security vulnerabilities by @​anthonyshew in #​11602
• fix: Upgrade @​actions/github to fix @​octokit vulnerabilities by @​anthonyshew in #​11607
• fix: Upgrade @​vercel/blob and @​actions packages to fix undici vulnerability by @​anthonyshew in #​11608
• docs: Running Root Tasks by @​Netail in #​11630
• Update README.md title and remove features section by @​anthonyshew in #​11651
• docs: Update using-environment-variables.mdx by @​anthonyshew in #​11652
• fix: Upgrade js-yaml to address CVE-2025-64718 by @​alexmkio in #​11650
• fix: Remove smooth scrolling from docs by @​anthonyshew in #​11654
• fix: Add sitemap link to 404 page and fix TurborepoLogo gradient by @​anthonyshew in #​11655

New Contributors

• @​ddmoney420 made their first contribution in #​11579
• @​i5d6 made their first contribution in #​11591
• @​Netail made their first contribution in #​11630
• @​alexmkio made their first contribution in #​11650

Full Changelog: vercel/turborepo@v2.8.1...v2.8.2

v2.8.1: Turborepo v2.8.1

Compare Source

What's Changed

Docs

• docs: Release post for 2.8 by @​anthonyshew in #​11559
• docs: Update oxc.mdx to include cache false by @​bestickley in #​11571
• docs: Fix curl markdown Accept header syntax in 2.8 release blog by @​marko-hologram in #​11580
• docs: Fix worktree command in blog post by @​anthonyshew in #​11583
• docs: Rename command → subcommand by @​anthonyshew in #​11584
• feat: Add requestType tracking for header-negotiated markdown by @​molebox in #​11585

Changelog

• fix: Support trailing commas in microfrontends JSONC files by @​anthonyshew in #​11573
• perf: Replace third-party crates with Rust std lib equivalents by @​anthonyshew in #​11569
• perf: Reduce duplicate dependency versions by @​anthonyshew in #​11568
• chore: Remove legacy Go/goreleaser buildcontainer directory by @​anthonyshew in #​11576
• chore: Rename README.md to RULE.md in skills directory by @​anthonyshew in #​11582
• fix: Validate turbo version from lockfile for all package managers by @​anthonyshew in #​11587

New Contributors

• @​bestickley made their first contribution in #​11571
• @​marko-hologram made their first contribution in #​11580

Full Changelog: vercel/turborepo@v2.8.0...v2.8.1

v2.8.0: Turborepo v2.8.0

Compare Source

What's Changed

Docs

• fix(docs): Hide line numbers for terminal code blocks by @​anthonyshew in #​11560
• fix: Disable pointer events on closed chat panel by @​anthonyshew in #​11561

@​turbo/repository

• chore: Update to Rust 1.93.0 by @​ognevny in #​11548

Changelog

• chore: Update docs:dev script filter to point to the correct documentation site path by @​yujiseok in #​11551
• docs(skills): Standardize --dry flag usage by @​jeniabrook in #​11550
• fix: Normalize ANSI escape codes in insta snapshots by @​anthonyshew in #​11564
• chore: Remove unused dependencies by @​anthonyshew in #​11565

New Contributors

• @​yujiseok made their first contribution in #​11551

Full Changelog: vercel/turborepo@v2.7.6...v2.8.0

v2.7.6: Turborepo v2.7.6

Compare Source

What's Changed

Docs

• fix: Fix AI chat not opening on home page by @​anthonyshew in #​11514
• docs: Add update-versioned-schema-json codemod documentation by @​anthonyshew in #​11513
• fix: Make showcase page logos theme-aware, grayscale by @​anthonyshew in #​11517
• fix: Sync favicon to browser theme preference on initial load by @​anthonyshew in #​11518
• docs: Add sitemap.md and link from all docs pages by @​anthonyshew in #​11515
• feat: Add md tracking for AI usage analytics by @​molebox in #​11526
• docs: Update $schema recommendation to use versioned subdomain by @​anthonyshew in #​11519
• feat: Add loading spinner while AI chat looks up sources by @​anthonyshew in #​11531
• fix: Use container queries for navbar to handle AI chat panel by @​anthonyshew in #​11532
• fix: Add turbo-site label to feedback submissions by @​molebox in #​11536
• fix(docs): Update "Edit this page on GitHub" link to new content path by @​clay-curry in #​11534
• fix: Move md tracking to middleware for static optimization by @​molebox in #​11535
• feat: Add stream-with-experimental-timestamps UI mode by @​anthonyshew in #​11538
• feat: Add CopyPrompt component for AI-assisted documentation by @​anthonyshew in #​11537
• fix: Simplify VersionWarning to show on all versioned subdomains by @​anthonyshew in #​11542

@​turbo/codemod

• feat(turbo-codemod): Add update-versioned-schema-json transformer by @​anthonyshew in #​11502

Changelog

• chore: Update serde to 1.0.228 and swc crates for compatibility by @​anthonyshew in #​11498
• fix(scope): Don't inject package name when user provides directory filter by @​anthonyshew in #​11500
• docs: Add READMEs for all Rust crates by @​anthonyshew in #​11503
• chore: Upgrade pnpm by @​anthonyshew in #​11506
• feat: Agent Skill by @​anthonyshew in #​11541
• chore: Update turborepo skill version during release by @​anthonyshew in #​11543
• fix: Validate turbo version from lockfile is a semver string by @​anthonyshew in #​11546

New Contributors

• @​clay-curry made their first contribution in #​11534

Full Changelog: vercel/turborepo@v2.7.5...v2.7.6

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.