Skip to content

Update(deps): Bump commander from 12.1.0 to 14.0.3 - #10

Merged
takashi-matsuyama merged 2 commits into
mainfrom
dependabot/npm_and_yarn/commander-14.0.3
May 27, 2026
Merged

Update(deps): Bump commander from 12.1.0 to 14.0.3#10
takashi-matsuyama merged 2 commits into
mainfrom
dependabot/npm_and_yarn/commander-14.0.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps commander from 12.1.0 to 14.0.3.

Release notes

Sourced from commander's releases.

v14.0.3

Added

  • Release Policy document (#2462)

Changes

  • old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date (#2462)
  • clarify typing for deprecated callback parameter to .outputHelp() (#2427)
  • simple readability improvements to README (#2465)

v14.0.2

Changed

  • improve negative number auto-detection test (#2428)
  • update (dev) dependencies

v14.0.1

Fixed

  • broken markdown link in README (#2369)

Changed

  • improve code readability by using optional chaining (#2394)
  • use more idiomatic code with object spread instead of Object.assign() (#2395)
  • improve code readability using string.endsWith() instead of string.slice() (#2396)
  • refactor .parseOptions() to process args array in-place (#2409)
  • change private variadic support routines from ._concatValue() to ._collectValue() (change code from array.concat() to array.push()) (#2410)
  • update (dev) dependencies

v14.0.0

Added

  • support for groups of options and commands in the help using low-level .helpGroup() on Option and Command, and higher -level .optionsGroup() and .commandsGroup() which can be used in chaining way to specify group title for following option s/commands (#2328)
  • support for unescaped negative numbers as option-arguments and command-arguments (#2339)
  • TypeScript: add parseArg property to Argument class (#2359)

Fixed

  • remove bogus leading space in help when option has default value but not a description (#2348)
  • .configureOutput() now makes copy of settings instead of modifying in-place, fixing side-effects (#2350)

Changed

  • Breaking: Commander 14 requires Node.js v20 or higher
  • internal refactor of Help class adding .formatItemList() and .groupItems() methods (#2328)

... (truncated)

Changelog

Sourced from commander's changelog.

[14.0.3] (2026-01-31)

Added

  • Release Policy document (#2462)

Changes

  • old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date (#2462)
  • clarify typing for deprecated callback parameter to .outputHelp() (#2427)
  • simple readability improvements to README (#2465)

[14.0.2] (2025-10-25)

Changed

  • improve negative number auto-detection test (#2428)
  • update (dev) dependencies

[14.0.1] (2025-09-12)

Fixed

  • broken markdown link in README (#2369)

Changed

  • improve code readability by using optional chaining (#2394)
  • use more idiomatic code with object spread instead of Object.assign() (#2395)
  • improve code readability using string.endsWith() instead of string.slice() (#2396)
  • refactor .parseOptions() to process args array in-place (#2409)
  • change private variadic support routines from ._concatValue() to ._collectValue() (change code from array.concat() to array.push()) (#2410)
  • update (dev) dependencies

[14.0.0] (2025-05-18)

Added

  • support for groups of options and commands in the help using low-level .helpGroup() on Option and Command, and higher-level .optionsGroup() and .commandsGroup() which can be used in chaining way to specify group title for following options/commands (#2328)
  • support for unescaped negative numbers as option-arguments and command-arguments (#2339)
  • TypeScript: add parseArg property to Argument class (#2359)

Fixed

  • remove bogus leading space in help when option has default value but not a description (#2348)
  • .configureOutput() now makes copy of settings instead of modifying in-place, fixing side-effects (#2350)

Changed

  • Breaking: Commander 14 requires Node.js v20 or higher

... (truncated)

Commits

@dependabot @github

dependabot Bot commented on behalf of github May 27, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@takashi-matsuyama

takashi-matsuyama commented May 27, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot
Update(deps): Bump commander from 12.1.0 to 14.0.3
182f28d 
Bumps [commander](https://github.com/tj/commander.js) from 12.1.0 to 14.0.3.
- [Release notes](https://github.com/tj/commander.js/releases)
- [Changelog](https://github.com/tj/commander.js/blob/master/CHANGELOG.md)
- [Commits](tj/commander.js@v12.1.0...v14.0.3)

---
updated-dependencies:
- dependency-name: commander
  dependency-version: 14.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/commander-14.0.3 branch from 10a6a49 to 182f28d Compare May 27, 2026 12:32
@takashi-matsuyama @claude
test(cli): adapt approval-reject case 21 to commander 14 propagation …
3880ea9 
…rules

commander 14 stopped propagating `exitOverride()` and `configureOutput()`
from a parent `Command` to its nested subcommands. Case 21 raises the
missing-required-option error on the leaf `approval reject` command, two
levels below the test's root program, so the previous setup never saw
`writeErr` and never caught the `CommanderError` - the worker just
printed to process.stderr and exited.

Reapply both overrides across the whole subcommand tree from inside the
test. The fix is idempotent on commander 12 (calling `exitOverride()`
twice on the same command is a no-op), so the test stays green either
way once the dependency bump lands.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@takashi-matsuyama
takashi-matsuyama merged commit 91ccfea into main May 27, 2026
7 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/commander-14.0.3 branch May 27, 2026 13:19
@takashi-matsuyama takashi-matsuyama mentioned this pull request Sep 3, 2026
Merged
takashi-matsuyama added a commit that referenced this pull request Sep 3, 2026
@takashi-matsuyama @claude
fix(deps): clear the dev tree's open security alerts in the lockfile (#…
038ec90 
…204)

Eight Dependabot alerts were open against pnpm-lock.yaml, all of them in
the dev dependency tree. Each package moves inside its existing range, so
no manifest changes:

  fast-uri         3.1.2 -> 3.1.7   (#24 GHSA-fph4-wmhf-6fwf,
                                     #20 GHSA-7p8r-x3mc-p8w7,
                                     #11 GHSA-v2hh-gcrm-f6hx,
                                     #10 GHSA-4c8g-83qw-93j6)
  postcss         8.5.13 -> 8.5.27  (#19 GHSA-fxqj-rqcc-2cmp,
                                     #13 GHSA-r28c-9q8g-f849)
  brace-expansion  2.1.1 -> 2.1.4   (#12 GHSA-3jxr-9vmj-r5cp)
  brace-expansion  5.0.6 -> 5.0.9   (#9  GHSA-3jxr-9vmj-r5cp)

nanoid 3.3.12 -> 3.3.18 comes along as postcss's own dependency.

The published packages were never affected. Dependabot labels the four
fast-uri alerts `runtime`, but its only path into the tree is
packages/core's devDependencies (ajv / ajv-formats); the published
@basou/core declares simple-git, ulid, yaml and zod alone.

That is also why CI stayed green while eight alerts sat open: the audit
job runs `pnpm audit --prod` by design, so a dev-only advisory never
reaches it. Whether to widen that gate, and whether to enable Dependabot
security updates (currently off, which is why none of these alerts opened
a PR of its own), are separate calls left untouched here.

One low advisory stays out of scope: esbuild 0.27.7 via tsup
(GHSA-g7r4-m6w7-qqqr, a Windows dev-server file read) is patched in
0.28.1, which needs a tsup bump rather than a lockfile refresh.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@takashi-matsuyama