chore(deps): update dependency release-it to v21

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
release-it	^20.2.1 → ^21.0.0

---

Release Notes

release-it/release-it (release-it)

v21.0.0

Compare Source

• fix(ci): do not run integration on forks (#​1315) (1e90d9f) - thanks @​trueberryless!
• Pin GitHub Actions to immutable commits (#​1316) (38355d8)
• Fix npm publish workspace config resolution (#​1312) (3bf251f) - thanks @​cyphercodes!
• Add gitlab.repoId option (#​1224) (e4e9d0e) - thanks @​microHoffman!
• Exit successfully when no release version is available (56c70c3)
• Support numeric GitLab repository IDs (0332c4a)
• Parse CLI arguments strictly (resolve #​1196) (caf77c9)
• fix: shell caching and working tree detection (#​1317) (8d1f752) - thanks @​Mopsgamer!
• Remove dependabot workflow (e7e04ef)
• Fix configured GitHub proxy routing (1ed9cdd)
• Upgrade dependencies and require Node 22 (c055e7f)
• Fix npm custom registry argument handling (resolve #​1318) (98c45c4)
• Pin GitLab releases to the current commit (resolve #​1216) (70ab576)
• Refresh GitHub Actions and package preview runtime (5c55139)
• Document v21 runtime requirements (daab846)
• Simplify git-cliff recipe (resolve #​1195) (52c89a7)
• Make GitLab CA tests platform-independent (ba4326f)
• Raise Node 22 requirement to 22.21 (df94838)
• Verify GitLab server certificates by default (c381a2d)
• Update changelog for v21 (2637e8a)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "after 10am and before 4pm every weekday"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Userscript Version Preview

Preview only — versions and CHANGELOGs are bumped automatically on merge to main, not in this PR. Manual bumps to a higher version are preserved.

Package	Base	New	Action
no package changes detected

[henry-nsheaps]

🟢 Approve — release-it v20 → v21

Renovate major bump of one dev dep. Two files: package.json and the corresponding yarn.lock churn. No source changes. PR was already automerged.

The v21 release notes call out three things that could reasonably bite a downstream: a Node ≥22.21 floor, a rewrite to strict CLI arg parsing (release-it/release-it#1196), and a refresh of the proxy-agent chain. I walked each against how this repo actually uses release-it and none of them apply.

Verification

Node floor — safe. package.json engines is >=24.18.0; .nvmrc = 24.18.0; mise.toml pins node = "24.19.0". All comfortably above the new 22.21 minimum.

CLI usage — safe. scripts/auto-bump-packages.sh invokes release-it in exactly one place:

if ! ( cd "$pkg_dir" && "$RELEASE_IT" --ci >&2 ); then

Just --ci, a first-class flag. Strict arg parsing has nothing to reject.

Config surface — safe. .release-it.base.json uses only git.{commit,tag,push,requireCleanWorkingDir,requireUpstream,getLatestTagFromAllRefs}, npm.publish, github.release, increment. Per-package .release-it.js files add the @release-it/conventional-changelog plugin (already at ^12.0.0, which is the v21-compatible line). None of these keys were removed or renamed in v21.

Publish path — safe. npm.publish: false and github.release: false mean the v21 fixes to npm workspace resolution (release-it/release-it#1312) and GitHub proxy routing don't touch this repo. Release publishing here is done directly by .github/workflows/release.yaml via gh release create, not by release-it.

Lockfile — consistent. The transitive churn is exactly what release-it 21.0.2 pulls in:

• @inquirer/core 11 → 12 (and every @inquirer/* prompt bumped in lockstep)
• proxy-agent chain: agent-base 8→9, http/https-proxy-agent 8→9, socks-proxy-agent 9→10, pac-{proxy,resolver}-agent 8→9, proxy-agent 7→8, plus new proxy-agent-negotiate@1.1.0 (kerberos is peer-optional, so no forced install)
• undici 7.28 → 7.29, ora 9.3 → 9.4, eta 4.5 → 4.6, semver 7.7.4 → 7.8.5, tinyglobby 0.2.15 → 0.2.17
• giget 2 → 3 (which is why citty, consola, node-fetch-native, nypm, tinyexec correctly drop out — v3 bundles its CLI deps)
• yargs-parser correctly removed (v21 dropped the direct dep)

No stray additions, no version splits, and the existing resolutions.yoctocolors pin is untouched.

Not flagged as issues, for completeness

• @release-it/conventional-changelog@^12.0.0 was already on the v21-compatible major before this PR, so no companion bump is needed.
• Renovate automerge is on, gated by CI (.github/workflows/ci.yml builds + tests every package). Given the analysis above, that's the right gate for a change this scoped.

Recommendation: approve. No follow-ups.