Skip to content

chore(deps): update external major (major)#248

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate-major-external-major
Open

chore(deps): update external major (major)#248
renovate[bot] wants to merge 1 commit into
mainfrom
renovate-major-external-major

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Mar 9, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
c8 10.1.3 → 11.0.0 age confidence devDependencies major
codecov/codecov-action v5 → v6 age confidence action major v6.0.1
lint-staged 16.2.7 → 17.0.4 age confidence devDependencies major 17.0.5
sinon (source) 21.0.1 → 22.0.0 age confidence devDependencies major

Release Notes

bcoe/c8 (c8)

v11.0.0

Compare Source

⚠ BREAKING CHANGES
  • deps: transitive deps require 20 || >=22
Bug Fixes
codecov/codecov-action (codecov/codecov-action)

v6.0.0

Compare Source

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0

v6

Compare Source

v5.5.4

Compare Source

This is a mirror of v5.5.2. v6 will be released which requires node24

What's Changed

Full Changelog: codecov/codecov-action@v5.5.3...v5.5.4

v5.5.3

Compare Source

What's Changed

Full Changelog: codecov/codecov-action@v5.5.2...v5.5.3

v5.5.2

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2

v5.5.1

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

v5.4.3

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.1..v5.4.2

v5.4.1

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.0..v5.4.1

v5.4.0

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.3.1..v5.4.0

v5.3.1

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.3.0..v5.3.1

v5.3.0

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.2.0..v5.3.0

v5.2.0

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.1.2..v5.2.0

v5.1.2

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.1.1..v5.1.2

v5.1.1

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.1.0..v5.1.1

v5.1.0

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.7..v5.1.0

v5.0.7

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.6..v5.0.7

v5.0.6

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.5..v5.0.6

v5.0.5

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.4..v5.0.5

v5.0.4

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.3..v5.0.4

v5.0.3

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.2..v5.0.3

v5.0.2

Compare Source

What's Changed

Full Changelog: codecov/codecov-action@v5.0.1...v5.0.2

v5.0.1

Compare Source

What's Changed

Full Changelog: codecov/codecov-action@v5.0.0...v5.0.1

lint-staged/lint-staged (lint-staged)

v17.0.4

Compare Source

Patch Changes

  • #​1788 f95c1f8 - Another fix for making sure lint-staged adds task modifications correctly to the commit in the following cases:

    • after editing <file> it is staged with git add <file>, and then committed with git commit
    • after editing <file> it is committed with git commit --all without explicit git add
    • after editing <file> it is committed with git commit <pathspec> without explicit git add

    There's new test cases which actually setup the Git pre_commit hook to run lint-staged and verify them. These issues started in v17.0.0 when trying to improve support for committig without having explicitly staged files.

v17.0.3

Compare Source

Patch Changes
  • #​1782 06813f9 Thanks @​iiroj! - Fix lint-staged behavior when implicitly committing files without using git add by either:
    • git commit -am "my commit message" where -a (--all) means to automatically stage all tracked modified and deleted files
    • git commit -m "my commit message" . where . is an example of a pathspec where matching files will be staged

v17.0.2

Compare Source

Patch Changes

v17.0.1

Compare Source

Patch Changes
  • #​1776 4a5664b Thanks @​iiroj! - Adjust GitHub Actions workflow so that automatic publishing works with signed commits.

v17.0.0

Compare Source

Major Changes

  • #​1745 e244adf Thanks @​iiroj! - Node.js v20 is no longer supported, and the oldest supported version is now 22.22.1, which is an active LTS version at the time of this release. Node.js 20 will be EOL after April 2026. Please upgrade your Node.js version!

  • #​1676 0584e0b Thanks @​outslept! - Lint-staged now tries to verify the installed Git version is at least 2.32.0, released in 2021. If you're using an even older Git version, you need to upgrade it before running lint-staged!

  • #​1745 2dcc40a Thanks @​iiroj! - The dependency yaml is now marked as optional and probably won't be installed by default. If you're using a YAML configuration file you should install the package separately:

    npm install --development yaml

    If you're using .lintstagedrc as the config file name (without a file extension), it will be treated as a YAML file. If the content is JSON, consider renaming it to .lintstagedrc.json to avoid needing to install yaml.

Minor Changes

  • #​1748 809d5ef Thanks @​iiroj! - Add new option --hide-all for hiding all unstaged changes and untracked files, before running tasks. This makes it easier to run tools like Knip which check for unused code. Untracked files are included in the backup stash and restored automatically after running.

  • #​1759 f13045a Thanks @​iiroj! - Update dependencies, including tinyexec@1.1.1 to fix the following issues:

    • When using a Node.js version manager with multiple versions installed (nvm, n, for example), scripts with the #!/usr/bin/env node shebang (Prettier, ESLint, for example) were previously spawned using the default Node.js version configured by the version manager (the one which node points to) on POSIX systems. Now, they will be spawned with the same version that lint-staged itself was started with.
      • For example, if your default Node.js version is 24.14.1 but lint-staged is run with the latest version 25.9.0, the tasks spawned by lint-staged will now also use version 25.9.0. Previously they were spawned using 24.14.1.
    • When installing Node.js from the Ubuntu App Center (Snap store), the node executable available in PATH is a symlink pointing to Snap itself. The sandboxing features of Snap prevented lint-staged from spawning scripts with the #!/usr/bin/env node shebang, because it meant lint-staged tried to spawn Snap via the symlink. This resulted in an ENOENT error when trying to run prettier, for example. Now, since the real node executable's directory is available in the PATH, lint-staged will instead spawn the script with the real node binary succesfully.

  • #​1761 d3251b1 Thanks @​iiroj! - Lint-staged now runs git update-index --again after running tasks, instead of git add <originally staged files>. This should improve compatibility when using non-default indexes, for example when committing with a pathspec git commit -m "message" . instead of adding files to the index.

  • #​1745 a9585ac Thanks @​iiroj! - Remove commander as a dependency and use the built-in parseArgs from node:util to parse CLI flags.

Patch Changes

  • #​1755 c82d30b Thanks @​iiroj! - All tests now pass on the Bun runtime (latest).

  • #​1750 a401818 Thanks @​iiroj! - Remove manual handling for git stash --keep-index resurrecting deleted files, because the issue was fixed in Git 2.23.0 and lint-staged requires at least Git 2.32.0.

  • #​1771 c4b8936 Thanks @​iiroj! - Fix documentation about multiple config files and the --cwd option. When using it, all tasks will be run in the specified directory. For example, to run everything in the actual process.cwd(), use lint-staged --cwd=".".

v16.4.0

Compare Source

Minor Changes

v16.3.4

Compare Source

Patch Changes

v16.3.3

Compare Source

Patch Changes
  • #​1740 0109e8d Thanks @​iiroj! - Make sure Git's warning about CRLF line-endings doesn't interfere with creating initial backup stash.

v16.3.2

Compare Source

Patch Changes
  • #​1735 2adaf6c Thanks @​iiroj! - Hide the extra cmd window on Windows by spawning tasks without the detached option.

v16.3.1

Compare Source

Patch Changes
  • #​1729 cd5d762 Thanks @​iiroj! - Remove nano-spawn as a dependency from package.json as it was replaced with tinyexec and is no longer used.

v16.3.0

Compare Source

Minor Changes

  • #​1698 feda37a Thanks @​iiroj! - Run external processes with tinyexec instead of nano-spawn. nano-spawn replaced execa in lint-staged version 16 to limit the amount of npm dependencies required, but caused some unknown issues related to spawning tasks. Let's hope tinyexec improves the situation.

  • #​1699 1346d16 Thanks @​iiroj! - Remove pidtree as a dependency. When a task fails, its sub-processes are killed more efficiently via the process group on Unix systems, and the taskkill command on Windows.

Patch Changes
  • #​1726 87467aa Thanks @​iiroj! - Incorrect brace expansions like *.{js} (nothing to expand) are detected exhaustively, instead of just a single pass.
sinonjs/sinon (sinon)

v22.0.0

Compare Source

  • ed911df5
    Update Ruby gems (Carl-Erik Kopseng)
  • 75a1e5b8
    Update to Node 26 (Carl-Erik Kopseng)
  • 197d6608
    Update documentation on faking timers to reflect the current state of fake-timers (Carl-Erik Kopseng)
  • c5ddf80b
    Update fake-timers@​15.4: includes new Temporal API (Carl-Erik Kopseng)
  • f4ab02f6
    Update updatable packages (Carl-Erik Kopseng)
  • 0536afc8
    Quality: Global mutable call id can grow unbounded across long-lived processes (#​2691) (tuanaiseo)
    • refactor: global mutable call id can grow unbounded across l

    callId is module-scoped and incremented on every invocation. In long-running test runners or embedded usage, this can grow indefinitely and eventually lose integer precision semantics for strict ordering comparisons.

    Affected files: proxy-invoke.js

    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com

    • Wrap around for all values that are too high

    Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
    Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com

  • f4f7d93b
    Perform additional cleanup when calling callThrough() (#​2670) (Cyrille)
  • 6199e9e4
    improve GitHubworkflows by introducing zizmor for monitoring (#​2686) (Till!)

    • fix(workflows): fetch-depth is for actions/checkout

    • chore(workflows): update

    • pin all actions to precise commits
    • avoid credential leakage from actions/checkout
    • group action updates going forward
    • add zimor config to ignore "secrets outside env"
    • add job to keep validating workflows
  • f7476b59
    Use path.normalize() for path normalization (Carl-Erik Kopseng)
  • 2c975393
    fix: make build and node test scripts cross-platform (laplace young)
  • a7692917
    fix: isolate walk state from Object prototype (laplace young)
  • 66df977a
    Fix sinon.restore() cascade-restoring sub-sandboxes (#​2704) (Charlie Leitheiser)

    The ESM port of createApi (#​2683, shipped in 21.1.0) replaced createSandbox: createSandbox with a wrapper that pushes every newly-created sandbox into the root sandbox's fake collection:

    createSandbox: function createSandbox(config) {
    const s = createConfiguredSandbox(config);
    sandbox.getFakes().push(s);
    return s;
}

    Sandbox#restore then walks that collection and calls .restore() on each entry. Because a sub-sandbox is itself an entry, every top-level sinon.restore() cascades into every sub-sandbox and undoes its stubs/timers/etc. — defeating the whole point of having an isolated sub-sandbox. The same cascade hits resetHistory and
    verifyAndRestore. This is the regression reported in #​2701.

    Restore the pre-21.1 behaviour: hand the root API a direct reference to createConfiguredSandbox. Sub-sandboxes are now isolated; only subSandbox.restore() (or verifyAndRestore) clears their fakes.

    Also flip the four sandbox tests that were locking in the buggy cascade: they now assert the parent's restore/resetHistory leaves the child untouched, with an explicit child-side cleanup at the
    end.

    Closes #​2701

  • f0bd6e1b
    fix: exclude proto from walk() (#​2699) (Kevin Locke)

    __proto__ is a special property to access an object's prototype. It
    has many pitfalls:

    • Setting it to an object value changes an object's prototype, which is
      generally discouraged and may be unexpected by the iterator callback.
    • Setting it to a non-object value does nothing (meaning seen[k] = true has no effect).
    • When Node.js is run with the --disable-proto=throw option, getting
      or setting __proto__ causes an exception with code
      ERR_PROTO_ACCESS to be thrown.

    Additionally, since this property (and all properties of
    Object.prototype) are currently unused in this project by consumers of
    walk(), it is both safe and preferable to exclude.

    Fixes: #​2695

    Signed-off-by: Kevin Locke kevin@kevinlocke.name

  • 1f8afd50
    chore: add context7.json for ownership confirmation (Morgan Roderick)

Released by Carl-Erik Kopseng on 2026-05-05.

v21.1.2

Compare Source

  • 53817f7d
    Upgrade to ESLint 10 and new shared config (#​2696) (Carl-Erik Kopseng)
    • Upgrade to ESLint 10 and new shared config
    • Update deps
  • d7a682e0
    fix: move npm-run-all to devDeps (#​2694) (Avi Vahl)

    used only during dev, and caused a considerable dep count jump downstream

  • 5b8720ec
    use latest shared eslint-config (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-04-11.

v21.1.1

Compare Source

  • 3c8b023b
    Update deps (Carl-Erik Kopseng)
  • 2eabf5da
    fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports (#​2693) (Carl-Erik Kopseng)
    • fix(#​2692): Remove ESM-only supports-color as it breaks CJS exports

Released by Carl-Erik Kopseng on 2026-04-10.

v21.1.0

Compare Source

  • 0a5526c5
    updated deps (Carl-Erik Kopseng)
  • 5262204f
    fix: build artifacts before running bundled tests (Carl-Erik Kopseng)
  • 819bb64b
    Migration to ECMAScript modules (ESM) (#​2683) (Carl-Erik Kopseng)

    This allowed us to finally consume ESM-only dependencies and has broken us free from some CJS shackes. Now produce the same API surface for CJS consumers, as well, by generating ./lib

    • Modern ignores 😁
    • test: add distribution harness
    • test: verify packed cjs and esm entrypoints
    • test: lock distribution api manifest
    • test: smoke test built pkg artifacts
    • docs: require contract tests for package migration
    • test: guard esm migration regressions
    • docs: require contract gate for esm migration
    • build: generate cjs lib from esm source entries
    • refactor: port root api surface to esm
    • build: clean port of root api to esm
    • docs: include implementation plans
    • fix: align lint and smoke tests with esm migration
    • refactor: complete esm port of all core components
    • refactor: finalize esm migration with sandbox and naming fixes
    • fix: finish esm migration stabilization
    • chore: stop tracking generated lib output
    • remove plans
    • prettier
    • linting
    • fix: make distribution tests self-contained
    • fix: build before coverage test bundle
    • refactor: move simple unit tests to src
    • refactor: flatten test and coverage script chains
    • refactor: use parallel mocha for node tests
    • test: restore fake timers cleanup
    • refactor: remove node test runner script
    • remove unneccessary clutter
    • fix: make mocha watch use polling
    • simplify
    • Increase coverage
    • Fix coverage by removing duplicated tests

    These were covering the generated lib/ folder.

    • Move shared util into esm dir
    • fix package dep issues
    • Adjust coverage
    • Upgrade all dependencies

    npx npm-check-updates -u

  • cd2bf5a3
    Use newer endpoint (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-04-09.

v21.0.3

Compare Source

  • 0494251b
    fix(#​2678): upgrade samsam to fix buffer comparisons (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-03-16.

v21.0.2

Compare Source

  • 024321c4
    fix: skip Node specific tests in browser env (Carl-Erik Kopseng)
  • b836fccb
    fix: js-yaml breaking change from v3 to v4 (Carl-Erik Kopseng)
  • ebf0c431
    docs: add how-to article for stubbing ES module imports (#​1832) (#​2676) (Eduard Barrera)
    • docs: add how-to article for stubbing ES module imports with esm package

    Adds a comprehensive How-To guide that addresses issue #​1832, documenting
    how to configure Node.js to allow Sinon stubs to work with ES modules.

    • Explains why ES module namespace bindings are immutable by spec
    • Shows how to use the 'esm' npm package with mutableNamespace: true
    • Provides a complete working example with project layout, package.json,
      loader file, source modules, and a full test suite
    • Documents limitations (destructured imports, non-standard behavior)
    • Replaces the TODO comment in link-seams-commonjs.md with a cross-reference

    Closes #​1832
    Co-authored-by: Eduard Barrera eduardbar@users.noreply.github.com
    Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com

  • ebcd506c
    Fix spies not being reset properly (#​2673) (simon-id)
  • 3beab2ba
    Make doc tests pass with new jQuery (Carl-Erik Kopseng)
  • 766715c6
    build: reduce transitive audit findings (Carl-Erik Kopseng)
  • 92aaf5c9
    build: upgrade eslint config and replace dependency-check (Carl-Erik Kopseng)
  • c6aaa871
    chore: ignore project worktrees (Carl-Erik Kopseng)
  • ef387e8e
    Upgrade most deps (Carl-Erik Kopseng)
  • 3cf4e77d
    docs: improve writing of documentation (#​2675) (Eduardo de la Cruz Palacios)
  • 6349032f
    Check login status before publishing steps are performed (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-03-04.

Configuration

📅 Schedule: (in timezone Europe/Zurich)

  • Branch creation
    • "after 2pm on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@codecov
Copy link
Copy Markdown

codecov Bot commented Mar 9, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@renovate renovate Bot force-pushed the renovate-major-external-major branch 2 times, most recently from 0dfa37d to 7c97a2a Compare March 12, 2026 07:42
@renovate renovate Bot force-pushed the renovate-major-external-major branch 5 times, most recently from 8fb63bd to c5648f7 Compare April 2, 2026 06:47
@renovate renovate Bot force-pushed the renovate-major-external-major branch 4 times, most recently from b6fa24e to d7961c8 Compare April 9, 2026 16:53
@renovate renovate Bot changed the title chore(deps): update dependency c8 to v11 chore(deps): update external major (major) Apr 9, 2026
@renovate renovate Bot force-pushed the renovate-major-external-major branch 2 times, most recently from 334e381 to 0d3f811 Compare April 20, 2026 17:45
@renovate renovate Bot force-pushed the renovate-major-external-major branch 12 times, most recently from 8f44c15 to e5190e2 Compare April 29, 2026 14:52
@renovate renovate Bot force-pushed the renovate-major-external-major branch 3 times, most recently from 04d82ef to f5835f1 Compare May 5, 2026 09:54
@renovate renovate Bot force-pushed the renovate-major-external-major branch 10 times, most recently from f1a4a42 to 572f57f Compare May 12, 2026 15:55
@renovate renovate Bot force-pushed the renovate-major-external-major branch 11 times, most recently from 9385e0d to 8e734c8 Compare May 23, 2026 21:58
@renovate renovate Bot force-pushed the renovate-major-external-major branch 2 times, most recently from 290c375 to 35b65da Compare May 29, 2026 09:05
@renovate renovate Bot force-pushed the renovate-major-external-major branch from 35b65da to 9aabc1e Compare May 29, 2026 09:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants