[Snyk] Upgrade lint-staged from 10.5.4 to 15.4.3 #102

nerdy-tech-com-gitub · 2025-03-23T02:04:20Z

Snyk has created this PR to upgrade lint-staged from 10.5.4 to 15.4.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

The recommended version is 83 versions ahead of your current version.
The recommended version was released 2 months ago.

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Denial of Service (DoS) SNYK-JS-DECODEURICOMPONENT-3149970	160	Proof of Concept
Asymmetric Resource Consumption (Amplification) SNYK-JS-BODYPARSER-7926860	160	No Known Exploit
Excessive Platform Resource Consumption within a Loop SNYK-JS-BRACES-6838727	160	Proof of Concept
Improper Handling of Extra Parameters SNYK-JS-FOLLOWREDIRECTS-6141137	160	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-GETFUNCNAME-5923417	160	Proof of Concept
Prototype Poisoning SNYK-JS-QS-3153490	160	Proof of Concept
Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	160	No Known Exploit
Denial of Service (DoS) SNYK-JS-WS-7266574	160	Proof of Concept
Inefficient Regular Expression Complexity SNYK-JS-MICROMATCH-6838728	160	No Known Exploit
Remote Code Execution (RCE) SNYK-JS-SHELLQUOTE-1766506	160	No Known Exploit
Prototype Poisoning SNYK-JS-QS-3153490	160	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	160	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	160	Proof of Concept
Cross-site Scripting (XSS) SNYK-JS-ROLLUP-8073097	160	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-BABELHELPERS-9397697	160	Proof of Concept
Cross-site Scripting (XSS) SNYK-JS-COOKIE-8163060	160	No Known Exploit
Improper Control of Dynamically-Managed Code Resources SNYK-JS-EJS-6689533	160	Proof of Concept
Information Exposure SNYK-JS-FOLLOWREDIRECTS-2332181	160	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-OCTOKITENDPOINT-8730856	160	Proof of Concept
Information Exposure SNYK-JS-FOLLOWREDIRECTS-6444610	160	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-OCTOKITREQUESTERROR-8730854	160	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-7925106	160	Proof of Concept
Improper Input Validation SNYK-JS-POSTCSS-5926692	160	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-LOADERUTILS-3042992	160	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-LOADERUTILS-3105943	160	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-UAPARSERJS-3244450	160	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	160	No Known Exploit
Information Exposure SNYK-JS-FOLLOWREDIRECTS-2396346	160	No Known Exploit
Prototype Pollution SNYK-JS-MINIMIST-2429795	160	Proof of Concept

Release notes

Package name: lint-staged

15.4.3 - 2025-01-26
Patch Changes
- #1512 cbfed1d Thanks @ tarik02! - Adjust TypeScript types for the default export so that it can be used as a value without error TS2693.
15.4.2 - 2025-01-23
Patch Changes
- #1509 8827ebf Thanks @ iiroj! - Change lint-staged's dependencies to use caret (^) ranges instead of tilde (~). This makes it easier for package managers to perform dependency management when minor-level updates are also permitted instead of just patch-level.
15.4.1 - 2025-01-16
Patch Changes
- #1504 1c7a45e Thanks @ iiroj! - Default TypeScript config filenames match JS equivalents.
- #1504 9cc18c9 Thanks @ iiroj! - Add missing conditional exports syntax for TypeScript types.
15.4.0 - 2025-01-16
Minor Changes
- #1500 a8ec1dd Thanks @ iiroj! - Lint-staged now provides TypeScript types for the configuration and main Node.js API. You can use the JSDoc syntax in your JS configuration files:
```
/**
 * @ filename: lint-staged.config.js
 * @ type {import('lint-staged').Configuration}
 */
export default {
  '*': 'prettier --write',
}
```
  It's also possible to use the .ts file extension for the configuration if your Node.js version supports it. The --experimental-strip-types flag was introduced in Node.js v22.6.0 and unflagged in v23.6.0, enabling Node.js to execute TypeScript files without additional configuration.
  
  export NODE_OPTIONS="--experimental-strip-types"
  
  npx lint-staged --config lint-staged.config.ts
Patch Changes
- #1501 9b79364 Thanks @ iiroj! - Handle possible failures when logging user shell for debug info.
15.3.0 - 2024-12-28
Minor Changes
- #1495 e69da9e Thanks @ iiroj! - Added more info to the debug logs so that "environment" info doesn't need to be added separately to GitHub issues.
- #1493 fa0fe98 Thanks @ iiroj! - Added more help messages around the automatic git stash that lint-staged creates as a backup (by default). The console output also displays the short git hash of the stash so that it's easier to recover lost files in case some fatal errors are encountered, or the process is killed before completing.
  
  For example:
```
% npx lint-staged
✔ Backed up original state in git stash (20addf8)
✔ Running tasks for staged files...
✔ Applying modifications from tasks...
✔ Cleaning up temporary files...
```
  where the backup can be seen with git show 20addf8, or git stash list:
```
% git stash list
stash@{0}: lint-staged automatic backup (20addf8)
```
15.2.11 - 2024-12-10
Patch Changes
- #1484 bcfe309 Thanks @ wormsik! - Escape paths containing spaces when using the "shell" option.
- #1487 7dd8caa Thanks @ iiroj! - Do not treat submodule root paths as "staged files". This caused lint-staged to fail to a Git error when only updating the revision of a submodule.
15.2.10 - 2024-09-01
Patch Changes
- #1471 e3f283b Thanks @ iiroj! - Update minor dependencies, including micromatch@~4.0.8.
15.2.9 - 2024-08-13
Patch Changes
- #1463 b69ce2d Thanks @ iiroj! - Set the maximum number of event listeners to the number of tasks. This should silence the console warning MaxListenersExceededWarning: Possible EventEmitter memory leak detected.
15.2.8 - 2024-08-03
Patch Changes
- f0480f0 Thanks @ iiroj! - In the previous version the native git rev-parse --show-toplevel command was taken into use for resolving the current git repo root. This version switched the --show-toplevel flag with --show-cdup, because on Git installed via MSYS2 the former was returning absolute paths that do not work with Node.js child_process. The new flag returns a path relative to the working directory, avoiding the issue.
  
  The GitHub Actions workflow has been updated to install Git via MSYS2, to ensure better future compatibility; using the default Git binary in the GitHub Actions runner was working correctly even with MSYS2.
15.2.7 - 2024-06-12
Patch Changes
- #1440 a51be80 Thanks @ iiroj! - In the previous version the native git rev-parse --show-toplevel command was taken into use for resolving the current git repo root. This version drops the --path-format=absolute option to support earlier git versions since it's also the default behavior. If you are still having trouble, please try upgrading git to the latest version.
15.2.6 - 2024-06-11
15.2.5 - 2024-05-25
15.2.4 - 2024-05-21
15.2.2 - 2024-02-05
15.2.1 - 2024-01-31
15.2.0 - 2023-12-03
15.1.0 - 2023-11-11
15.0.2 - 2023-10-19
15.0.1 - 2023-10-15
15.0.0 - 2023-10-14
14.0.1 - 2023-08-21
14.0.0 - 2023-08-13
13.3.0 - 2023-08-13
13.2.3 - 2023-06-28
13.2.2 - 2023-04-26
13.2.1 - 2023-04-07
13.2.0 - 2023-03-10
13.1.4 - 2023-03-06
13.1.3 - 2023-03-05
13.1.2 - 2023-02-13
13.1.1 - 2023-02-07
13.1.0 - 2022-12-04
13.0.4 - 2022-11-25
13.0.3 - 2022-06-24
13.0.2 - 2022-06-16
13.0.1 - 2022-06-08
13.0.0 - 2022-06-01
12.5.0 - 2022-05-31
12.4.3 - 2022-05-30
12.4.2 - 2022-05-24
12.4.1 - 2022-04-26
12.4.0 - 2022-04-20
12.3.8 - 2022-04-15
12.3.7 - 2022-03-17
12.3.6 - 2022-03-16
12.3.5 - 2022-03-05
12.3.4 - 2022-02-13
12.3.3 - 2022-02-01
12.3.2 - 2022-01-26
12.3.1 - 2022-01-23
12.3.0 - 2022-01-23
12.2.2 - 2022-01-20
12.2.1 - 2022-01-19
12.2.0 - 2022-01-18
12.1.7 - 2022-01-07
12.1.6 - 2022-01-07
12.1.5 - 2022-01-02
12.1.4 - 2021-12-24
12.1.3 - 2021-12-18
12.1.2 - 2021-11-22
12.1.1 - 2021-11-21
12.1.0 - 2021-11-21
12.0.3 - 2021-11-18
12.0.2 - 2021-11-14
12.0.1 - 2021-11-13
12.0.0 - 2021-11-13
11.3.0-beta.2 - 2021-10-30
11.3.0-beta.1 - 2021-10-04
11.2.6 - 2021-10-26
11.2.5 - 2021-10-26
11.2.4 - 2021-10-23
11.2.3 - 2021-10-10
11.2.2 - 2021-10-09
11.2.1 - 2021-10-09
11.2.0 - 2021-10-04
11.2.0-beta.1 - 2021-10-02
11.1.4 - 2021-10-02
11.1.3 - 2021-10-02
11.1.2 - 2021-08-06
11.1.1 - 2021-07-24
11.1.0 - 2021-07-22
11.0.1 - 2021-07-13
11.0.0 - 2021-05-07
10.5.4 - 2021-02-05

from lint-staged GitHub release notes

Important

Warning: This PR contains a major version upgrade, and may be a breaking change.
Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Summary by Sourcery

Upgrade lint-staged from 10.5.4 to 15.4.3 to address multiple security vulnerabilities and incorporate the latest features and fixes.

Bug Fixes:

Addresses multiple security vulnerabilities, including Denial of Service (DoS), Prototype Poisoning, and Regular Expression Denial of Service (ReDoS).

Enhancements:

Includes TypeScript types for configuration and Node.js API.
Adds more info to debug logs.
Adds more help messages around the automatic git stash.

Snyk has created this PR to upgrade lint-staged from 10.5.4 to 15.4.3. See this package in npm: lint-staged See this project in Snyk: https://app.snyk.io/org/nerds-github/project/bf4e0bbc-6133-4196-a6ba-f683223a4e51?utm_source=github&utm_medium=referral&page=upgrade-pr

sourcery-ai · 2025-03-23T02:04:25Z

Reviewer's Guide by Sourcery

This pull request upgrades the lint-staged dependency from version 10.5.4 to 15.4.3. This upgrade includes several security fixes and improvements.

No diagrams generated as the changes look simple and do not need a visual representation.

File-Level Changes

Change	Details	Files
The pull request upgrades the `lint-staged` dependency from version 10.5.4 to 15.4.3.	Updated the `lint-staged` version in `package.json`.	`package.json`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!
Generate a plan of action for an issue: Comment @sourcery-ai plan on
an issue to generate a plan of action for it.

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

sourcery-ai

We have skipped reviewing this pull request. Here's why:

It seems to have been created by a bot ('[Snyk]' found in title). We assume it knows what it's doing!
We don't review packaging changes - Let us know if you'd like us to change this.

sourcery-ai bot reviewed Mar 23, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade lint-staged from 10.5.4 to 15.4.3 #102

[Snyk] Upgrade lint-staged from 10.5.4 to 15.4.3 #102

nerdy-tech-com-gitub commented Mar 23, 2025 •

edited by sourcery-ai bot

Loading

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

sourcery-ai bot commented Mar 23, 2025 •

edited

Loading

Interacting with Sourcery

Customizing Your Experience

Getting Help

sourcery-ai bot left a comment

[Snyk] Upgrade lint-staged from 10.5.4 to 15.4.3 #102

Are you sure you want to change the base?

[Snyk] Upgrade lint-staged from 10.5.4 to 15.4.3 #102

Conversation

nerdy-tech-com-gitub commented Mar 23, 2025 • edited by sourcery-ai bot Loading

Snyk has created this PR to upgrade lint-staged from 10.5.4 to 15.4.3.

Issues fixed by the recommended upgrade:

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Summary by Sourcery

sourcery-ai bot commented Mar 23, 2025 • edited Loading

Reviewer's Guide by Sourcery

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

sourcery-ai bot left a comment

Choose a reason for hiding this comment

nerdy-tech-com-gitub commented Mar 23, 2025 •

edited by sourcery-ai bot

Loading

sourcery-ai bot commented Mar 23, 2025 •

edited

Loading