[Snyk] Upgrade lint-staged from 12.3.7 to 16.2.0#2
Conversation
Snyk has created this PR to upgrade lint-staged from 12.3.7 to 16.2.0. See this package in npm: lint-staged See this project in Snyk: https://app.snyk.io/org/dustin4444/project/d86d6d0d-45cd-44c7-9a82-8b3987b70cc2?utm_source=github&utm_medium=referral&page=upgrade-pr
Summary of ChangesHello @Dustin4444, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request, automatically generated by Snyk, updates the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Important Review skippedIgnore keyword(s) in the title. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request upgrades lint-staged from 12.3.7 to 16.2.0. While this is a valuable security update, it introduces a significant breaking change. The new version of lint-staged requires Node.js v20.17.0 or higher, but this project still supports Node.js v18. This will cause the pre-commit hook to fail for developers using Node.js 18. I have added a comment with a suggestion to either upgrade to a lint-staged version that is compatible with Node.js 18, or to update the project's engines configuration to drop support for Node.js 18.
| "eslint-doc-generator": "^1.7.0", | ||
| "eslint-plugin-eslint-plugin": "^5.5.1", | ||
| "lint-staged": "^12.3.7", | ||
| "lint-staged": "^16.2.0", |
There was a problem hiding this comment.
This major upgrade of lint-staged to version 16.2.0 introduces a Node.js version requirement that is incompatible with this project's supported engines.
lint-staged@16.2.0requires Node.js>=20.17.0.- Your
package.jsonenginesfield specifies support for Node.js^18.18.0.
This will cause the pre-commit hook to fail for developers running Node.js 18.
To resolve this while still addressing security vulnerabilities, you could upgrade to the latest 15.x version instead. For example, lint-staged@15.5.2 is compatible with Node.js 18. Alternatively, if you plan to drop support for Node.js 18, the engines field in package.json should be updated.
| "lint-staged": "^16.2.0", | |
| "lint-staged": "^15.5.2", |
2 participants
Snyk has created this PR to upgrade lint-staged from 12.3.7 to 16.2.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 55 versions ahead of your current version.
The recommended version was released 22 days ago.
Issues fixed by the recommended upgrade:
SNYK-JS-IP-12704893
SNYK-JS-IP-12761655
SNYK-JS-IP-6240864
SNYK-JS-IP-7148531
SNYK-JS-SEMVERREGEX-2824151
SNYK-JS-TAR-6476909
SNYK-JS-MICROMATCH-6838728
SNYK-JS-BRACEEXPANSION-9789073
SNYK-JS-BRACEEXPANSION-9789073
Release notes
Package name: lint-staged
-
16.2.0 - 2025-09-22
-
-
-
-
-
-
-
-
-
-
-
16.1.6 - 2025-09-01
- #1610
-
16.1.5 - 2025-08-08
- #1608
-
16.1.4 - 2025-08-03
- #1604
-
16.1.3 - 2025-08-03
- #1602
-
16.1.2 - 2025-06-15
-
-
-
16.1.1 - 2025-06-14
-
-
-
-
16.1.0 - 2025-05-27
-
-
- #1558
-
16.0.0 - 2025-05-10
-
-
# my-script.sh
-
-
-
-
15.5.2 - 2025-05-06
- #1544
-
15.5.1 - 2025-04-11
-
15.5.0 - 2025-03-12
-
15.4.3 - 2025-01-26
-
15.4.2 - 2025-01-23
-
15.4.1 - 2025-01-16
-
15.4.0 - 2025-01-16
-
15.3.0 - 2024-12-28
-
15.2.11 - 2024-12-10
-
15.2.10 - 2024-09-01
-
15.2.9 - 2024-08-13
-
15.2.8 - 2024-08-03
-
15.2.7 - 2024-06-12
-
15.2.6 - 2024-06-11
-
15.2.5 - 2024-05-25
-
15.2.4 - 2024-05-21
-
15.2.2 - 2024-02-05
-
15.2.1 - 2024-01-31
-
15.2.0 - 2023-12-03
-
15.1.0 - 2023-11-11
-
15.0.2 - 2023-10-19
-
15.0.1 - 2023-10-15
-
15.0.0 - 2023-10-14
-
14.0.1 - 2023-08-21
-
14.0.0 - 2023-08-13
-
13.3.0 - 2023-08-13
-
13.2.3 - 2023-06-28
-
13.2.2 - 2023-04-26
-
13.2.1 - 2023-04-07
-
13.2.0 - 2023-03-10
-
13.1.4 - 2023-03-06
-
13.1.3 - 2023-03-05
-
13.1.2 - 2023-02-13
-
13.1.1 - 2023-02-07
-
13.1.0 - 2022-12-04
-
13.0.4 - 2022-11-25
-
13.0.3 - 2022-06-24
-
13.0.2 - 2022-06-16
-
13.0.1 - 2022-06-08
-
13.0.0 - 2022-06-01
-
12.5.0 - 2022-05-31
-
12.4.3 - 2022-05-30
-
12.4.2 - 2022-05-24
-
12.4.1 - 2022-04-26
-
12.4.0 - 2022-04-20
-
12.3.8 - 2022-04-15
-
12.3.7 - 2022-03-17
from lint-staged GitHub release notesMinor Changes
#1615
99eb742Thanks @ iiroj! - Added a new option--fail-on-changesto make lint-staged exit with code 1 when tasks modify any files, making theprecommithook fail. This is similar to thegit diff --exit-codeoption. Using this flag also implies the--no-revertflag which means any changes made by tasks will be left in the working tree after failing, so that they can be manually staged and the commit tried again.#1611
cd05fd3Thanks @ rlorenzo! - Added a new option--continue-on-errorso that lint-staged will run all tasks to completion even if some of them fail. By default, lint-staded will exit early on the first failure.#1637
82fcc07Thanks @ iiroj! - Internal lint-staged errors are now thrown and visible in the console output. Previously they were caught with the process exit code set to 1, but not logged. This happens when, for example, there's a syntax error in the lint-staged configuration file.#1647
a5ecc06Thanks @ iiroj! - Remove debug as a dependency due to recent malware issue; read more at debug-js/debug#1005. Because of this, theDEBUGenvironment variable is no longer supported — use the--debugto enable debugging#1636
8db2717Thanks @ iiroj! - Added a new option--hide-unstagedso that lint-staged will hide all unstaged changes to tracked files before running tasks. The changes will be applied back after running the tasks. Note that the combination of flags--hide-unstaged --no-hide-partially-stagedisn't meaningful and behaves the same as just--hide-unstaged.Thanks to @ ItsNickBarry for the idea and initial implementation in #1552.
#1648
7900b3bThanks @ iiroj! - Remove lilconfig to reduce reliance on third-party dependencies. It was used to find possible config files outside of those tracked in Git, including from the parent directories. This behavior has been moved directly into lint-staged and should work about the same.Patch Changes
#1633
7f9e485Thanks @ dependabot! - Bumps listr2 from 9.0.3 to 9.0.4.#1626
99d5a9bThanks @ iiroj! - Due to recent phishing attacks, for example chalk@5.6.1 was released with malware. To avoid lint-staged's users being at risk the direct dependencies are pinned to exact versions, instead of allowing future patch versions with the caret (^) range.#1588
035bbf2Thanks @ outslept! - Increase performance by listing staged files and searching for configuration concurrently.#1645
deba3adThanks @ iiroj! - Remove chalk as a dependency due to recent malware issue; read more at chalk/chalk#656.If you are having trouble with ANSI color codes when using lint-staged, you can try setting either
FORCE_COLOR=trueorNO_COLOR=trueenv variables.Patch Changes
e93578eThanks @ iiroj! - Try to improve terminating of subprocess of tasks by usingSIGKILL, and only callingpidtreewhen the the main task process has a known pid.Patch Changes
4e3ce22Thanks @ srsatt! - Detect the git repo's top-level directory correctly when in a worktree.Patch Changes
90b37b0Thanks @ iiroj! - Add anothertypesfield topackage.jsonto make even more sure NPM detects that lint-staged includes built-in TypeScript type definitions.Patch Changes
7ea700bThanks @ dword-design! - Add thetypesfield topackage.jsonto make sure NPM detects lint-staged includes built-in TypeScript type definitions.Patch Changes
#1570
a7c0c88Thanks @ ItsNickBarry! - When using--diff-filterwith theDoption to include deleted staged files, lint-staged no longer tries to stage the deleted files, unless they're no longer deleted. Previously this caused an error fromgit addlikefatal: pathspec 'deleted-file' did not match any files.38f942eThanks @ iiroj! - Removed an extraneous log entry that printedshouldHidePArtiallyStagedFilesto console output.Patch Changes
#1565
3686977Thanks @ iiroj! - Lint-staged now explicitly warns about potential data loss when using--no-stash.#1571
02299a9Thanks @ iiroj! - Function tasks (introduced in v16.0.0) only receive the staged files matching the configured glob, instead of all staged files.#1563
bc61c74Thanks @ iiroj! - This version fixes incorrect behavior where unstaged changes were committed when using the--no-stashoption. This happened because--no-stashimplied--no-hide-partially-staged, meaning unstaged changes to files which also had other staged changes were added to the commit by lint-staged; this is no longer the case.The previous (incorrect) behavior can still be achieved by using both options
--no-stash --no-hide-partially-stagedat the same time.Minor Changes
#1536
e729daaThanks @ iiroj! - A new flag--no-reverthas been introduced for when task modifications should be applied to the index before aborting the commit in case of errors. By default, lint-staged will clear all task modifications and revert to the original state.#1550
b27fa3fThanks @ iiroj! - Lint-staged now ignores symlinks and leaves them out from the list of staged files.Patch Changes
c37dc38Thanks @ iiroj! - The minimum required Node.js version is lowered to20.17following nano-spawn@1.0.2.Major Changes
#1546
158d15cThanks @ iiroj! - Processes are spawned using nano-spawn instead of execa. If you are using Node.js scripts as tasks, you might need to explicitly run them withnode, especially when using Windows:{ "*.js": "node my-js-linter.js" }#1546
158d15cThanks @ iiroj! - The--shellflag has been removed and lint-staged no longer supports evaluating commands directly via a shell. To migrate existing commands, you can create a shell script and invoke it instead. Lint-staged will pass matched staged files as a list of arguments, accessible via"$@":#!/bin/bash
echo "Staged files: $@"
and
{ "*.js": "my-script.sh" }If you were using the shell option to avoid passing filenames to tasks, for example
bash -c 'tsc --noEmit', use the function syntax instead:#1546
158d15cThanks @ iiroj! - Validation for deprecated advanced configuration has been removed. The advanced configuration was removed in lint-staged version 9 and until now validation has failed if advanced configuration options were detected. Going forward the entire configuration will be treated with the same logic and if these advanced options are still present, they might be treated as valid globs for staged files instead.#1546
158d15cThanks @ iiroj! - The lowest supported Node.js version is20.18. Please upgrade your Node.js version.Minor Changes
#1401
27110efThanks @ RohitLuthra19! - Added support for directly running functions on staged files. To configure a function task, use an object with a title and the task itself:Lint-staged will run your function task with the staged files matching the configured glob as its argument, and show the custom title in its console output.
Patch Changes
5561321Thanks @ YimingIsCOLD! - Correctly handle colon (:) characters in staged filenames.Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information: