v23.2.12

Update dependency webpack-cli to v7

Notable changes

• feat(cli): refresh the --help output using commander's configureHelp API — branded headers, section dividers, colorized terms and a clearer footer. Colors and chrome collapse to plain text when output is piped or --no-color is used, so scripts keep working. (by @​alexander-akait in #​4779)
• feat: support .json5, .yaml/.yml and .toml configuration files by parsing them directly, with the parser package (json5, js-yaml, toml) installed on demand by the user and declared as optional peerDependencies so the parsers resolve correctly under Yarn PnP (by @​alexander-akait in #​4777)
• Improved CLI startup performance and reduced memory usage. (by @​alexander-akait in #​4765)
• Reduced CLI startup CPU and memory usage by caching schema-derived argument metadata, registering only the options present in the arguments, and reading config directories once during default-config discovery. (by @​alexander-akait in #​4760)
• Replace the fastest-levenshtein dependency with a small in-tree implementation used for command/option "did you mean" suggestions. (by @​alexander-akait in #​4762)
• Resolve configuration path for cache build dependencies. (by @​alexander-akait in #​4707)
• The file protocol for configuration options (--config/--extends) is supported. (by @​alexander-akait in #​4702)
• The minimum supported version of Node.js is 20.9.0. (by @​alexander-akait in #​4677)
• Use dynamic import to load webpack.config.js, fallback to interpret only when configuration can't be load by dynamic import. Using dynamic imports allows you to take advantage of Node.js's built-in TypeScript support. (by @​alexander-akait in #​4677)
• Removed the --node-env argument in favor of the --config-node-env argument. (by @​alexander-akait in #​4677)
• The version command only output versions right now. (by @​alexander-akait in #​4677)
• Removed deprecated API, no action required unless you use import cli from "webpack-cli";/const cli = require("webpack-cli");. (by @​alexander-akait in #​4677)
• Allow configuration freezing. (by @​alexander-akait in #​4677)
• Use graceful shutdown when file system cache is enabled. (by @​alexander-akait in #​4677)
• Performance improved. (by @​alexander-akait in #​4677)

webpack/webpack-cli (webpack-cli)

v7.1.0

Compare Source

Minor Changes

• feat(cli): refresh the --help output using commander's configureHelp API — branded headers, section dividers, colorized terms and a clearer footer. Colors and chrome collapse to plain text when output is piped or --no-color is used, so scripts keep working. (by @​alexander-akait in #​4779)

• feat: support .json5, .yaml/.yml and .toml configuration files by parsing them directly, with the parser package (json5, js-yaml, toml) installed on demand by the user and declared as optional peerDependencies so the parsers resolve correctly under Yarn PnP (by @​alexander-akait in #​4777)

v7.0.3

Compare Source

Patch Changes

• Improved CLI startup performance and reduced memory usage. (by @​alexander-akait in #​4765)

• Reduced CLI startup CPU and memory usage by caching schema-derived argument metadata, registering only the options present in the arguments, and reading config directories once during default-config discovery. (by @​alexander-akait in #​4760)

• Replace the fastest-levenshtein dependency with a small in-tree implementation used for command/option "did you mean" suggestions. (by @​alexander-akait in #​4762)

v7.0.2

Compare Source

Patch Changes

• Resolve configuration path for cache build dependencies. (by @​alexander-akait in #​4707)

v7.0.1

Compare Source

Patch Changes

• The file protocol for configuration options (--config/--extends) is supported. (by @​alexander-akait in #​4702)

v7.0.0

Compare Source

Major Changes

• The minimum supported version of Node.js is 20.9.0. (by @​alexander-akait in #​4677)

• Use dynamic import to load webpack.config.js, fallback to interpret only when configuration can't be load by dynamic import. Using dynamic imports allows you to take advantage of Node.js's built-in TypeScript support. (by @​alexander-akait in #​4677)

• Removed the --node-env argument in favor of the --config-node-env argument. (by @​alexander-akait in #​4677)

• The version command only output versions right now. (by @​alexander-akait in #​4677)

• Removed deprecated API, no action required unless you use import cli from "webpack-cli";/const cli = require("webpack-cli");. (by @​alexander-akait in #​4677)

Patch Changes

• Allow configuration freezing. (by @​alexander-akait in #​4677)

• Use graceful shutdown when file system cache is enabled. (by @​alexander-akait in #​4677)

• Performance improved. (by @​alexander-akait in #​4677)

List of commits

d92cc3d (Update dependency webpack-cli to v7, 2026-07-01)

v23.2.11

1cad40a (Update tests after API's switch from is_online to is_connected_to_vpn, 2026-07-01)
70526f0 (Rerun lint-fix, 2026-07-01)

v23.2.10

b0b5cfc (Switch from custom Dictionary type to built in Record typing, 2026-06-16)

v23.2.9

Update dependency sinon to v22

Notable changes

• ed911df5
• 75a1e5b8
• 197d6608
• c5ddf80b
• f4ab02f6
• 0536afc8
• f4f7d93b
• 6199e9e4
• f7476b59
• 2c975393
• a7692917
• 66df977a
• f0bd6e1b
• 1f8afd50

sinonjs/sinon (sinon)

v22.0.0

Compare Source

• ed911df5
  Update Ruby gems (Carl-Erik Kopseng)
• 75a1e5b8
  Update to Node 26 (Carl-Erik Kopseng)
• 197d6608
  Update documentation on faking timers to reflect the current state of fake-timers (Carl-Erik Kopseng)
• c5ddf80b
  Update fake-timers@​15.4: includes new Temporal API (Carl-Erik Kopseng)
• f4ab02f6
  Update updatable packages (Carl-Erik Kopseng)
• 0536afc8
  Quality: Global mutable call id can grow unbounded across long-lived processes (#​2691) (tuanaiseo)

  • refactor: global mutable call id can grow unbounded across l

  callId is module-scoped and incremented on every invocation. In long-running test runners or embedded usage, this can grow indefinitely and eventually lose integer precision semantics for strict ordering comparisons.

  Affected files: proxy-invoke.js

  Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com

  • Wrap around for all values that are too high

  ---

  Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
  Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com

• f4f7d93b
  Perform additional cleanup when calling callThrough() (#​2670) (Cyrille)
• 6199e9e4
  improve GitHubworkflows by introducing zizmor for monitoring (#​2686) (Till!)

  • fix(workflows): fetch-depth is for actions/checkout

  • chore(workflows): update

  • pin all actions to precise commits
  • avoid credential leakage from actions/checkout
  • group action updates going forward
  • add zimor config to ignore "secrets outside env"
  • add job to keep validating workflows

• f7476b59
  Use path.normalize() for path normalization (Carl-Erik Kopseng)
• 2c975393
  fix: make build and node test scripts cross-platform (laplace young)
• a7692917
  fix: isolate walk state from Object prototype (laplace young)
• 66df977a
  Fix sinon.restore() cascade-restoring sub-sandboxes (#​2704) (Charlie Leitheiser)

  The ESM port of createApi (#​2683, shipped in 21.1.0) replaced createSandbox: createSandbox with a wrapper that pushes every newly-created sandbox into the root sandbox's fake collection:

  createSandbox: function createSandbox(config) {
      const s = createConfiguredSandbox(config);
      sandbox.getFakes().push(s);
      return s;
  }
  

  Sandbox#restore then walks that collection and calls .restore() on each entry. Because a sub-sandbox is itself an entry, every top-level sinon.restore() cascades into every sub-sandbox and undoes its stubs/timers/etc. — defeating the whole point of having an isolated sub-sandbox. The same cascade hits resetHistory and
  verifyAndRestore. This is the regression reported in #​2701.

  Restore the pre-21.1 behaviour: hand the root API a direct reference to createConfiguredSandbox. Sub-sandboxes are now isolated; only subSandbox.restore() (or verifyAndRestore) clears their fakes.

  Also flip the four sandbox tests that were locking in the buggy cascade: they now assert the parent's restore/resetHistory leaves the child untouched, with an explicit child-side cleanup at the
  end.

  Closes #​2701

• f0bd6e1b
  fix: exclude proto from walk() (#​2699) (Kevin Locke)

  __proto__ is a special property to access an object's prototype. It
  has many pitfalls:

  • Setting it to an object value changes an object's prototype, which is
    generally discouraged and may be unexpected by the iterator callback.
  • Setting it to a non-object value does nothing (meaning seen[k] = true has no effect).
  • When Node.js is run with the --disable-proto=throw option, getting
    or setting __proto__ causes an exception with code
    ERR_PROTO_ACCESS to be thrown.

  Additionally, since this property (and all properties of
  Object.prototype) are currently unused in this project by consumers of
  walk(), it is both safe and preferable to exclude.

  Fixes: #​2695

  Signed-off-by: Kevin Locke kevin@kevinlocke.name

• 1f8afd50
  chore: add context7.json for ownership confirmation (Morgan Roderick)

Released by Carl-Erik Kopseng on 2026-05-05.

List of commits

aed3e81 (Update dependency sinon to v22, 2026-06-10)

v23.2.8

Update dependency lint-staged to v17

Notable changes

• #​1806 e692e58 - Update dependency tinyexec@^1.2.4.
• #​1803 bdf2770 - Run all tests with Deno, in addition to Node.js and Bun.
• #​1796 7508272 - Fix performance regression of lint-staged v17 by going back to using git add to stage task modifications. This was changed to git update-index --again in v17 for less manual work, but unfortunately the update-index command gets slower in very large Git repos.
• #​1797 7b2505a - This version of lint-staged uses the new staged publishing for npm packages feature. Releases are already published from GitHub Actions with trusted publishing, but now an additional approval with two-factor authentication is also required.
• #​1802 321b0a9 - Downgrade dependency tinyexec@1.2.2 to avoid issues in version 1.2.3.
• #​1792 1f67271 - Correctly set the --max-arg-length default value based on the running platform. This controls how very long lists of staged files are split into multiple chunks.
• #​1788 f95c1f8 - Another fix for making sure lint-staged adds task modifications correctly to the commit in the following cases:
• #​1782 06813f9 Thanks @​iiroj! - Fix lint-staged behavior when implicitly committing files without using git add by either:
• #​1779 88670ca Thanks @​iiroj! - Enable immutable GitHub releases
• #​1776 4a5664b Thanks @​iiroj! - Adjust GitHub Actions workflow so that automatic publishing works with signed commits.
• #​1745 e244adf Thanks @​iiroj! - Node.js v20 is no longer supported, and the oldest supported version is now 22.22.1, which is an active LTS version at the time of this release. Node.js 20 will be EOL after April 2026. Please upgrade your Node.js version!
• #​1676 0584e0b Thanks @​outslept! - Lint-staged now tries to verify the installed Git version is at least 2.32.0, released in 2021. If you're using an even older Git version, you need to upgrade it before running lint-staged!
• #​1745 2dcc40a Thanks @​iiroj! - The dependency yaml is now marked as optional and probably won't be installed by default. If you're using a YAML configuration file you should install the package separately:
• #​1748 809d5ef Thanks @​iiroj! - Add new option --hide-all for hiding all unstaged changes and untracked files, before running tasks. This makes it easier to run tools like Knip which check for unused code. Untracked files are included in the backup stash and restored automatically after running.
• #​1759 f13045a Thanks @​iiroj! - Update dependencies, including tinyexec@1.1.1 to fix the following issues:
• #​1761 d3251b1 Thanks @​iiroj! - Lint-staged now runs git update-index --again after running tasks, instead of git add <originally staged files>. This should improve compatibility when using non-default indexes, for example when committing with a pathspec git commit -m "message" . instead of adding files to the index.
• #​1745 a9585ac Thanks @​iiroj! - Remove commander as a dependency and use the built-in parseArgs from node:util to parse CLI flags.
• #​1755 c82d30b Thanks @​iiroj! - All tests now pass on the Bun runtime (latest).
• #​1750 a401818 Thanks @​iiroj! - Remove manual handling for git stash --keep-index resurrecting deleted files, because the issue was fixed in Git 2.23.0 and lint-staged requires at least Git 2.32.0.
• #​1771 c4b8936 Thanks @​iiroj! - Fix documentation about multiple config files and the --cwd option. When using it, all tasks will be run in the specified directory. For example, to run everything in the actual process.cwd(), use lint-staged --cwd=".".

lint-staged/lint-staged (lint-staged)

v17.0.7

Compare Source

Patch Changes

• #​1806 e692e58 - Update dependency tinyexec@^1.2.4.

v17.0.6

Compare Source

Patch Changes

• #​1803 bdf2770 - Run all tests with Deno, in addition to Node.js and Bun.

• #​1796 7508272 - Fix performance regression of lint-staged v17 by going back to using git add to stage task modifications. This was changed to git update-index --again in v17 for less manual work, but unfortunately the update-index command gets slower in very large Git repos.

• #​1797 7b2505a - This version of lint-staged uses the new staged publishing for npm packages feature. Releases are already published from GitHub Actions with trusted publishing, but now an additional approval with two-factor authentication is also required.

• [#​1802](https://redirect.github.com/lin...

v23.2.7

ff9c7ad (Update balena-auth to deduplicate balena-errors, 2026-06-10)

v23.2.6

7bb797e (Rename .linstagedrc to .lintstagedrc.json, 2026-06-10)

v23.2.5

Update dependency rimraf to v6

Notable changes

isaacs/rimraf (rimraf)

v6.1.3

Compare Source

v6.1.2

Compare Source

v6.1.1

Compare Source

v6.1.0

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

List of commits

59b42e1 (Update dependency rimraf to v6, 2026-06-10)

v23.2.4

Update dependency balena-errors to v5

Notable changes

• Fix docs regenerating missing fns [Otavio Jacobi]
• Add id-token: write permission for NPM OIDC publishing [Otavio Jacobi]

balena-io-modules/balena-errors (balena-errors)

v5.0.1

Compare Source

(2026-03-19)

• Fix docs regenerating missing fns [Otavio Jacobi]
• Add id-token: write permission for NPM OIDC publishing [Otavio Jacobi]

List of commits

64a094f (Update dependency balena-errors to v5, 2026-06-08)

v23.2.3

0f04cc3 (Update GitHub Actions to 48b55a0, 2026-06-05)