Bump lint-staged from 13.2.2 to 16.2.1 #3662

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Closed

dependabot wants to merge 1 commit into master from dependabot/npm_and_yarn/lint-staged-16.2.1

Closed

Bump lint-staged from 13.2.2 to 16.2.1 #3662

dependabot wants to merge 1 commit into master from dependabot/npm_and_yarn/lint-staged-16.2.1

Conversation

dependabot[bot]

Copy link

Contributor

@dependabot dependabot bot commented on behalf of github Sep 26, 2025

Bumps lint-staged from 13.2.2 to 16.2.1.

Release notes

Sourced from lint-staged's releases.

v16.2.1

Patch Changes
#1664 8277b3b Thanks @iiroj! - The built-in TypeScript types have been updated to more closely match the implementation. Notably, the list of staged files supplied to task functions is readonly string[] and can't be mutated. Thanks @outslept!
export default {
--- "*": (files: string[]) => void console.log('staged files', files)
+++ "*": (files: readonly string[]) => void console.log('staged files', files)
}
#1654 70b9af3 Thanks @iiroj! - This version has been published from GitHub Actions using Trusted Publishing for npm packages.

#1659 4996817 Thanks @iiroj! - Fix searching configuration files when the working directory is a subdirectory of a git repository, and there are package.json files in the working directory. This situation might happen when running lint-staged for a single package in a monorepo.

#1654 7021f0a Thanks @iiroj! - Return the caret semver range (^) to direct dependencies so that future patch and minor versions are allowed. This enables projects to better maintain and deduplicate their own transitive dependencies while not requiring direct updates to lint-staged. This was changed in 16.2.0 after the vulnerability issues with chalk and debug, which were also removed in the same version.

Given the recent vulnerabilities in the npm ecosystem, it's best to be very careful when updating dependencies.
v16.2.0

Minor Changes

#1615 99eb742 Thanks @iiroj! - Added a new option --fail-on-changes to make lint-staged exit with code 1 when tasks modify any files, making the precommit hook fail. This is similar to the git diff --exit-code option. Using this flag also implies the --no-revert flag which means any changes made by tasks will be left in the working tree after failing, so that they can be manually staged and the commit tried again.

#1611 cd05fd3 Thanks @rlorenzo! - Added a new option --continue-on-error so that lint-staged will run all tasks to completion even if some of them fail. By default, lint-staded will exit early on the first failure.

#1637 82fcc07 Thanks @iiroj! - Internal lint-staged errors are now thrown and visible in the console output. Previously they were caught with the process exit code set to 1, but not logged. This happens when, for example, there's a syntax error in the lint-staged configuration file.

#1647 a5ecc06 Thanks @iiroj! - Remove debug as a dependency due to recent malware issue; read more at debug-js/debug#1005. Because of this, the DEBUG environment variable is no longer supported — use the --debug to enable debugging

#1636 8db2717 Thanks @iiroj! - Added a new option --hide-unstaged so that lint-staged will hide all unstaged changes to tracked files before running tasks. The changes will be applied back after running the tasks. Note that the combination of flags --hide-unstaged --no-hide-partially-staged isn't meaningful and behaves the same as just --hide-unstaged.

Thanks to @ItsNickBarry for the idea and initial implementation in #1552.

#1648 7900b3b Thanks @iiroj! - Remove lilconfig to reduce reliance on third-party dependencies. It was used to find possible config files outside of those tracked in Git, including from the parent directories. This behavior has been moved directly into lint-staged and should work about the same.

Patch Changes

#1633 7f9e485 Thanks @dependabot! - Bumps listr2 from 9.0.3 to 9.0.4.

#1626 99d5a9b Thanks @iiroj! - Due to recent phishing attacks, for example chalk@5.6.1 was released with malware. To avoid lint-staged's users being at risk the direct dependencies are pinned to exact versions, instead of allowing future patch versions with the caret (^) range.

#1588 035bbf2 Thanks @outslept! - Increase performance by listing staged files and searching for configuration concurrently.

#1645 deba3ad Thanks @iiroj! - Remove chalk as a dependency due to recent malware issue; read more at chalk/chalk#656.

If you are having trouble with ANSI color codes when using lint-staged, you can try setting either FORCE_COLOR=true or NO_COLOR=true env variables.

v16.1.6

... (truncated)

Changelog

Sourced from lint-staged's changelog.

16.2.1

Patch Changes
#1664 8277b3b Thanks @iiroj! - The built-in TypeScript types have been updated to more closely match the implementation. Notably, the list of staged files supplied to task functions is readonly string[] and can't be mutated. Thanks @outslept!
export default {
--- "*": (files: string[]) => void console.log('staged files', files)
+++ "*": (files: readonly string[]) => void console.log('staged files', files)
}
#1654 70b9af3 Thanks @iiroj! - This version has been published from GitHub Actions using Trusted Publishing for npm packages.

#1659 4996817 Thanks @iiroj! - Fix searching configuration files when the working directory is a subdirectory of a git repository, and there are package.json files in the working directory. This situation might happen when running lint-staged for a single package in a monorepo.

#1654 7021f0a Thanks @iiroj! - Return the caret semver range (^) to direct dependencies so that future patch and minor versions are allowed. This enables projects to better maintain and deduplicate their own transitive dependencies while not requiring direct updates to lint-staged. This was changed in 16.2.0 after the vulnerability issues with chalk and debug, which were also removed in the same version.

Given the recent vulnerabilities in the npm ecosystem, it's best to be very careful when updating dependencies.
16.2.0

Minor Changes

#1615 99eb742 Thanks @iiroj! - Added a new option --fail-on-changes to make lint-staged exit with code 1 when tasks modify any files, making the precommit hook fail. This is similar to the git diff --exit-code option. Using this flag also implies the --no-revert flag which means any changes made by tasks will be left in the working tree after failing, so that they can be manually staged and the commit tried again.

#1611 cd05fd3 Thanks @rlorenzo! - Added a new option --continue-on-error so that lint-staged will run all tasks to completion even if some of them fail. By default, lint-staded will exit early on the first failure.

#1637 82fcc07 Thanks @iiroj! - Internal lint-staged errors are now thrown and visible in the console output. Previously they were caught with the process exit code set to 1, but not logged. This happens when, for example, there's a syntax error in the lint-staged configuration file.

#1647 a5ecc06 Thanks @iiroj! - Remove debug as a dependency due to recent malware issue; read more at debug-js/debug#1005. Because of this, the DEBUG environment variable is no longer supported — use the --debug to enable debugging

#1636 8db2717 Thanks @iiroj! - Added a new option --hide-unstaged so that lint-staged will hide all unstaged changes to tracked files before running tasks. The changes will be applied back after running the tasks. Note that the combination of flags --hide-unstaged --no-hide-partially-staged isn't meaningful and behaves the same as just --hide-unstaged.

Thanks to @ItsNickBarry for the idea and initial implementation in #1552.

#1648 7900b3b Thanks @iiroj! - Remove lilconfig to reduce reliance on third-party dependencies. It was used to find possible config files outside of those tracked in Git, including from the parent directories. This behavior has been moved directly into lint-staged and should work about the same.

Patch Changes

#1633 7f9e485 Thanks @dependabot! - Bumps listr2 from 9.0.3 to 9.0.4.

#1626 99d5a9b Thanks @iiroj! - Due to recent phishing attacks, for example chalk@5.6.1 was released with malware. To avoid lint-staged's users being at risk the direct dependencies are pinned to exact versions, instead of allowing future patch versions with the caret (^) range.

#1588 035bbf2 Thanks @outslept! - Increase performance by listing staged files and searching for configuration concurrently.

#1645 deba3ad Thanks @iiroj! - Remove chalk as a dependency due to recent malware issue; read more at chalk/chalk#656.

If you are having trouble with ANSI color codes when using lint-staged, you can try setting either FORCE_COLOR=true or NO_COLOR=true env variables.

... (truncated)

Commits

b62e72e chore(changeset): release
b320abd docs: add example to changelog
e1dd5bb fix: use boolean type for failOnChanges
8277b3b fix: update built-in TypeScript types
6286f31 perf: load each config file only once
de970bb fix: remove use of "git restore" because it resets file contents instead of a...
673fdc3 perf: use "git stash" to directly hide unstaged files
b111dc8 docs: fix typo in CHANGELOG.md
d2b0b73 build(deps-dev): bump @eslint/js from 9.35.0 to 9.36.0
4996817 fix: always search configuration from both Git and FS
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for lint-staged since your current version.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot


 Bump lint-staged from 13.2.2 to 16.2.1

9836c3d

Bumps [lint-staged](https://github.com/lint-staged/lint-staged) from 13.2.2 to 16.2.1.
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v13.2.2...v16.2.1)
---
updated-dependencies:
- dependency-name: lint-staged
 dependency-version: 16.2.1
 dependency-type: direct:development
 update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>