Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.

...

2 commits
4 files changed
1 contributor

Commits on Sep 28, 2025

Update dependency lint-staged to v16.2.2 (#1305 )

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs
from Renovate will soon appear from 'Mend'. Learn more
[here](https://redirect.github.com/renovatebot/renovate/discussions/37842).

This PR contains the following updates:

| Package | Change | Age | Confidence |
|---|---|---|---|
| [lint-staged](https://redirect.github.com/lint-staged/lint-staged) |
[`16.1.4` ->
`16.2.2`](https://renovatebot.com/diffs/npm/lint-staged/16.1.4/16.2.2) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/lint-staged/16.2.2?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/lint-staged/16.1.4/16.2.2?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>lint-staged/lint-staged (lint-staged)</summary>

###
[`v16.2.2`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1622)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.1...409d79a3fc15235ffa14e61db07bfa2ac12cd691)

##### Patch Changes

-
[#&#8203;1667](https://redirect.github.com/lint-staged/lint-staged/pull/1667)
[`699f95d`](https://redirect.github.com/lint-staged/lint-staged/commit/699f95df8f89ac7f7d360bbf93740d19d5899ac5)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - The backup
stash will not be dropped when using `--fail-on-changes` and there are
errors. When reverting to original state is disabled (via `--no-revert`
or `--fail-on-changes`), hidden (partially) unstaged changes are still
restored automatically so that it's easier to resolve the situation
manually.

Additionally, the example for using the backup stash manually now uses
the correct backup hash, if available:

  ```shell
  % npx lint-staged --fail-on-changes
  ✔ Backed up original state in git stash (c18d55a3)
  ✔ Running tasks for staged files...
  ✖ Tasks modified files and --fail-on-changes was used!
  ↓ Cleaning up temporary files...

  ✖ lint-staged failed because `--fail-on-changes` was used.

  Any lost modifications can be restored from a git stash:

    > git stash list --format="%h %s"
    c18d55a3 On main: lint-staged automatic backup
    > git apply --index c18d55a3
  ```

###
[`v16.2.1`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1621)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.0...v16.2.1)

##### Patch Changes

-
[#&#8203;1664](https://redirect.github.com/lint-staged/lint-staged/pull/1664)
[`8277b3b`](https://redirect.github.com/lint-staged/lint-staged/commit/8277b3b298421ebbb39c43d7e3538481e15c4659)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - The
built-in TypeScript types have been updated to more closely match the
implementation. Notably, the list of staged files supplied to task
functions is `readonly string[]` and can't be mutated. Thanks
[@&#8203;outslept](https://redirect.github.com/outslept)!

  ```diff
  export default {
  ---  "*": (files: string[]) => void console.log('staged files', files)
+++ "*": (files: readonly string[]) => void console.log('staged files',
files)
  }
  ```

-
[#&#8203;1654](https://redirect.github.com/lint-staged/lint-staged/pull/1654)
[`70b9af3`](https://redirect.github.com/lint-staged/lint-staged/commit/70b9af3ac3fd66af94936e55bb3e91381937b41f)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - This
version has been published from GitHub Actions using [Trusted Publishing
for npm packages](https://docs.npmjs.com/trusted-publishers).

-
[#&#8203;1659](https://redirect.github.com/lint-staged/lint-staged/pull/1659)
[`4996817`](https://redirect.github.com/lint-staged/lint-staged/commit/49968170abb3bab7ac8dc0a6bc5ea92850337baa)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Fix
searching configuration files when the working directory is a
subdirectory of a git repository, and there are `package.json` files in
the working directory. This situation might happen when running
*lint-staged* for a single package in a monorepo.

-
[#&#8203;1654](https://redirect.github.com/lint-staged/lint-staged/pull/1654)
[`7021f0a`](https://redirect.github.com/lint-staged/lint-staged/commit/7021f0af40ac1d5787501894c0f2222980023703)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Return the
caret semver range (`^`) to direct dependencies so that future patch and
minor versions are allowed. This enables projects to better maintain and
deduplicate their own transitive dependencies while not requiring direct
updates to *lint-staged*. This was changed in
[16.2.0](https://redirect.github.com/lint-staged/lint-staged/releases/tag/v16.2.0)
after the vulnerability issues with `chalk` and `debug`, which were also
removed in the same version.

Given the recent vulnerabilities in the *npm* ecosystem, it's best to be
very careful when updating dependencies.

###
[`v16.2.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1620)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.1.6...v16.2.0)

##### Minor Changes

-
[#&#8203;1615](https://redirect.github.com/lint-staged/lint-staged/pull/1615)
[`99eb742`](https://redirect.github.com/lint-staged/lint-staged/commit/99eb74200e8db69e72dba45314025953b8b0794e)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Added a new
option `--fail-on-changes` to make *lint-staged* exit with code 1 when
tasks modify any files, making the `precommit` hook fail. This is
similar to the `git diff --exit-code` option. Using this flag also
implies the `--no-revert` flag which means any changes made my tasks
will be left in the working tree after failing, so that they can be
manually staged and the commit tried again.

-
[#&#8203;1611](https://redirect.github.com/lint-staged/lint-staged/pull/1611)
[`cd05fd3`](https://redirect.github.com/lint-staged/lint-staged/commit/cd05fd349594baf586fbafb05588ff07d86060b7)
Thanks [@&#8203;rlorenzo](https://redirect.github.com/rlorenzo)! - Added
a new option `--continue-on-error` so that *lint-staged* will run all
tasks to completion even if some of them fail. By default, *lint-staded*
will exit early on the first failure.

-
[#&#8203;1637](https://redirect.github.com/lint-staged/lint-staged/pull/1637)
[`82fcc07`](https://redirect.github.com/lint-staged/lint-staged/commit/82fcc0789c17bf6b2ea2649147abec77fa619375)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Internal
*lint-staged* errors are now thrown and visible in the console output.
Previously they were caught with the process exit code set to 1, but not
logged. This happens when, for example, there's a syntax error in the
*lint-staged* configuration file.

-
[#&#8203;1647](https://redirect.github.com/lint-staged/lint-staged/pull/1647)
[`a5ecc06`](https://redirect.github.com/lint-staged/lint-staged/commit/a5ecc0605d52756167417c84cb0007ea7bceaaa3)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Remove
[debug](https://redirect.github.com/debug-js/debug) as a dependency due
to recent malware issue; read more at
[debug-js/debug#1005](https://redirect.github.com/debug-js/debug/issues/1005).
Because of this, the `DEBUG` environment variable is no longer supported
— use the `--debug` to enable debugging

-
[#&#8203;1636](https://redirect.github.com/lint-staged/lint-staged/pull/1636)
[`8db2717`](https://redirect.github.com/lint-staged/lint-staged/commit/8db2717574ebfa2b80e0fc4eb0b24d705fd264fc)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Added a new
option `--hide-unstaged` so that *lint-staged* will hide all unstaged
changes to tracked files before running tasks. The changes will be
applied back after running the tasks. Note that the combination of flags
`--hide-unstaged --no-hide-partially-staged` isn't meaningful and
behaves the same as just `--hide-unstaged`.

Thanks to
[@&#8203;ItsNickBarry](https://redirect.github.com/ItsNickBarry) for the
idea and initial implementation in
[#&#8203;1552](https://redirect.github.com/lint-staged/lint-staged/pull/1552).

-
[#&#8203;1648](https://redirect.github.com/lint-staged/lint-staged/pull/1648)
[`7900b3b`](https://redirect.github.com/lint-staged/lint-staged/commit/7900b3b79c5e2e69662cb8b1bcbcae79c3549421)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Remove
[lilconfig](https://redirect.github.com/antonk52/lilconfig) to reduce
reliance on third-party dependencies. It was used to find possible
config files outside of those tracked in Git, including from the parent
directories. This behavior has been moved directly into *lint-staged*
and should work about the same.

##### Patch Changes

-
[#&#8203;1633](https://redirect.github.com/lint-staged/lint-staged/pull/1633)
[`7f9e485`](https://redirect.github.com/lint-staged/lint-staged/commit/7f9e485a981707897e0d417f6a62008f0c098e00)
Thanks
[@&#8203;dependabot](https://redirect.github.com/apps/dependabot)! -
Bumps [listr2](https://redirect.github.com/listr2/listr2) from 9.0.3 to
9.0.4.

-
[#&#8203;1626](https://redirect.github.com/lint-staged/lint-staged/pull/1626)
[`99d5a9b`](https://redirect.github.com/lint-staged/lint-staged/commit/99d5a9b0ddcba7d471d39ff3969d37988f1e2705)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Due to
recent phishing attacks, for example
[chalk@5.6.1](https://redirect.github.com/chalk/chalk/issues/656) was
released with malware. To avoid *lint-staged*'s users being at risk the
**direct dependencies are pinned to exact versions**, instead of
allowing future patch versions with the [caret (`^`)
range](https://docs.npmjs.com/cli/v6/using-npm/semver#caret-ranges-123-025-004).

-
[#&#8203;1588](https://redirect.github.com/lint-staged/lint-staged/pull/1588)
[`035bbf2`](https://redirect.github.com/lint-staged/lint-staged/commit/035bbf268ac47bbaf2cfa737c3b2240d38feb22e)
Thanks [@&#8203;outslept](https://redirect.github.com/outslept)! -
Increase performance by listing staged files and searching for
configuration concurrently.

-
[#&#8203;1645](https://redirect.github.com/lint-staged/lint-staged/pull/1645)
[`deba3ad`](https://redirect.github.com/lint-staged/lint-staged/commit/deba3ad83581938dd71b86b563e62827b5fc2a0a)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Remove
[chalk](https://redirect.github.com/chalk/chalk) as a dependency due to
recent malware issue; read more at
[chalk/chalk#656](https://redirect.github.com/chalk/chalk/issues/656).

If you are having trouble with ANSI color codes when using
*lint-staged*, you can try setting either `FORCE_COLOR=true` or
`NO_COLOR=true` env variables.

###
[`v16.1.6`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1616)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.1.5...v16.1.6)

##### Patch Changes

-
[#&#8203;1610](https://redirect.github.com/lint-staged/lint-staged/pull/1610)
[`e93578e`](https://redirect.github.com/lint-staged/lint-staged/commit/e93578e265a69ed6b02fcaa11486078c1bdbdaaa)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Try to
improve terminating of subprocess of tasks by using `SIGKILL`, and only
calling `pidtree` when the the main task process has a known pid.

###
[`v16.1.5`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1615)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.1.4...v16.1.5)

##### Patch Changes

-
[#&#8203;1608](https://redirect.github.com/lint-staged/lint-staged/pull/1608)
[`4e3ce22`](https://redirect.github.com/lint-staged/lint-staged/commit/4e3ce225b33f759f78a84d156189dc38e536cdc6)
Thanks [@&#8203;srsatt](https://redirect.github.com/srsatt)! - Detect
the git repo's top-level directory correctly when in a worktree.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/snowcoders/scaffold-typescript-cli--github).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45MS4xIiwidXBkYXRlZEluVmVyIjoiNDEuMTMwLjEiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate[bot] authored Sep 28, 2025

Update actions/checkout action to v5

renovate[bot] authored Sep 28, 2025
Configuration menu
View commit details

Copy full SHA for 3b271de

Browse repository at this point
Copy the full SHA

3b271de View commit details

Browse the repository at this point in the history