deps(deps): bump the major-updates group with 8 updates

[dependabot]

Bumps the major-updates group with 8 updates:

Package	From	To
js-yaml	4.3.2	5.4.1
@semantic-release/changelog	6.0.3	7.0.0
@semantic-release/git	10.0.1	11.0.1
@semantic-release/github	11.0.6	12.0.9
globals	16.5.0	17.11.0
lint-staged	15.5.2	17.4.1
semantic-release	24.2.9	25.0.9
conventional-changelog-conventionalcommits	8.0.0	10.4.0

Updates js-yaml from 4.3.2 to 5.4.1

Changelog

Sourced from js-yaml's changelog.

[5.4.1] - 2026-08-26

Changed

• Hard-limit merge sequence size to 100.

Security

• Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

• Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

• [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
• [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
• Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

• Accept a byte order mark at the start of each document in a stream, #791.
• Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.
• Preserve empty scalar items when converting block sequences to flow style.
• Do not apply the 1024-character simple-key limit to flow mapping keys.
• Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
• Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

[5.3.0] - 2026-08-14

This release focuses on reworking the documentation and making small architectural improvements before moving forward.

Added

• Added completely new documentation.
• Exported DUMP_SCHEMA, the default schema used by the dumper.
• Added YAMLException.throwAt() for throwing an error at a source position.

Changed

... (truncated)

Commits

• e5a3ba0 5.4.1 released
• e54dea3 Hard-limit merge sequence size to 100
• dfd3a29 Cleanup 6a8e05f, #797
• 6a8e05f fix: count empty merge sources against maxTotalMergeKeys (#797)
• 6b4ff5e 5.4.0 released
• 3b3625e Update changelog
• 4f25a74 Fix file name
• 3bd003b Expose new scalar styling API
• fbb3e9d Remove regex lookbehind for ES2015 compatibility
• d43c185 Fix flowSkipColonSpace by forcing quoteFlowKeys
• Additional commits viewable in compare view

Updates @semantic-release/changelog from 6.0.3 to 7.0.0

Release notes

Sourced from @​semantic-release/changelog's releases.

v7.0.0

7.0.0 (2026-07-21)

Features

• ES Module (#414) (e154214)

BREAKING CHANGES

• @semantic-release/changelog is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use @semantic-release/changelog is now v20.1.0

Other Notable Changes

• Replaced xo with prettier with default configuration; following newly established convention
• Replaced nyc with c8 for code coverage
• Replaced lodash with lodash-es for proper esm support

Related Issue

• semantic-release/semantic-release#2133
• semantic-release/semantic-release#4032

v7.0.0-beta.1

7.0.0-beta.1 (2026-04-23)

Features

• ES Module (#414) (e154214)

BREAKING CHANGES

• @semantic-release/changelog is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use @semantic-release/changelog is now v20.1.0

Other Notable Changes

... (truncated)

Commits

• b1044e1 chore(ci): update Node.js version requirements and test matrix configurations
• 0563e5d chore(deps): update to the latest semantic-release version (#417)
• e154214 feat: ES Module (#414)
• 15e48e4 chore(deps): update dependency sinon to v18.0.1 (#400)
• 1c48000 test: remove codecov (#399)
• 3be34e3 ci(action): update actions/setup-node action to v4.0.3 (#395)
• 854ffb6 ci(action): update actions/checkout action to v4.1.7 (#393)
• e7c79f8 chore(deps): update dependency nyc to v17 (#392)
• 171adfb ci(action): update actions/checkout action to v4.1.6 (#390)
• 13e3bf7 chore(deps): update dependency sinon to v18 (#389)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​semantic-release/changelog since your current version.

Updates @semantic-release/git from 10.0.1 to 11.0.1

Release notes

Sourced from @​semantic-release/git's releases.

v11.0.1

11.0.1 (2026-07-24)

Bug Fixes

• deps: update dependency execa to v10 (#564) (b39d5c6)

v11.0.0

11.0.0 (2026-07-21)

Features

• ES Module (#544) (4d704a2), closes #491 #490

BREAKING CHANGES

• @semantic-release/git is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use @semantic-release/git is now v20.1.0

v11.0.0-beta.2

11.0.0-beta.2 (2026-07-20)

Bug Fixes

• update Node.js engine version requirements in package.json and package-lock.json (ddf699e)

v11.0.0-beta.1

11.0.0-beta.1 (2026-07-17)

Features

• ES Module (#526) (e523946), closes #491 #490

BREAKING CHANGES

• @semantic-release/git is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use @semantic-release/changelog is now v20.1.0

Other Notable Changes

... (truncated)

Commits

• b39d5c6 fix(deps): update dependency execa to v10 (#564)
• 9dd61f1 chore(deps): lock file maintenance (#470)
• c5c6f06 chore(deps): update dependency lodash-es to v4.18.1 [security] (#545)
• b67458c ci(action): update actions/setup-node action to v6.5.0 (#557)
• d4990ff ci(action): update actions/checkout action to v6.1.0 (#556)
• 16d191f chore(deps): update dependency tempy to v3.2.0 (#448)
• 8efa7b7 chore(deps): update dependency sinon to v21.1.2 (#554)
• e53dc53 chore(deps): update dependency prettier to v3.9.5 (#552)
• 4c2f87f chore(deps): update dependency ls-engines to v0.10.1 (#551)
• 7685d83 chore(deps): update dependency ava to v6.4.1 (#548)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​semantic-release/git since your current version.

Updates @semantic-release/github from 11.0.6 to 12.0.9

Release notes

Sourced from @​semantic-release/github's releases.

v12.0.9

12.0.9 (2026-07-01)

Bug Fixes

• asset-upload: stop setting content-length header manually (241f966), closes #1224
• local-undici: always use the locally installed undici instead of the node built-in version (40973e3), closes #1224
• publish: handle content-length header properly for asset uploads (#1260) (28e3741), closes #1224 #1224

v12.0.8

12.0.8 (2026-05-08)

Bug Fixes

• deps: update dependency http-proxy-agent to v9 (#1203) (edd1652)

v12.0.7

12.0.7 (2026-05-08)

Bug Fixes

• deps: update dependency https-proxy-agent to v9 (#1204) (1f17362)

v12.0.6

12.0.6 (2026-02-12)

Bug Fixes

• latest: add make_latest property to the GH release PATCH request during publish (#1169) (f516337)

v12.0.5

12.0.5 (2026-02-07)

Bug Fixes

• latest: add make_latest property to the GH release POST request during publish (#1157) (38051ba)

v12.0.4

12.0.4 (2026-02-06)

Bug Fixes

• remove failTitle arg in findSRIssues call (#1164) (f7bdd88)

... (truncated)

Commits

• 28e3741 fix(publish): handle content-length header properly for asset uploads (#1260)
• 241f966 fix(asset-upload): stop setting content-length header manually
• 40973e3 fix(local-undici): always use the locally installed undici instead of the nod...
• 8879ae4 chore(deps): update dependency prettier to v3.9.1 (#1259)
• bf720e2 chore(deps): update dependency prettier to v3.9.0 (#1258)
• b34e0ec chore(deps): update dependency prettier to v3.8.5 (#1257)
• b445fa0 chore(deps): update dependency ls-engines to v0.10.1 (#1256)
• 4ca0ef4 chore(deps): lock file maintenance (#1255)
• bb9fdb3 chore(deps): update dependency undici to v7.28.0 [security] (#1254)
• 059c6ce ci(action): update actions/checkout action to v7 (#1252)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​semantic-release/github since your current version.

Updates globals from 16.5.0 to 17.11.0

Release notes

Sourced from globals's releases.

v17.11.0

• Add react-native globals (#337) 61eafbf

---

sindresorhus/globals@v17.10.0...v17.11.0

v17.10.0

• Add GM_cookie to Greasemonkey globals (#349) f468407

---

sindresorhus/globals@v17.9.0...v17.10.0

v17.9.0

• Update globals (2026-08-01) (#348) 5a958ed

---

sindresorhus/globals@v17.8.0...v17.9.0

v17.8.0

• Update globals (2026-07-01) (#347) 7394811

---

sindresorhus/globals@v17.7.0...v17.8.0

v17.7.0

• Update globals (2026-06-22) (#345) 33b75f9

---

sindresorhus/globals@v17.6.0...v17.7.0

v17.6.0

• Update globals (2026-05-01) (#343) 00a4dd9

---

sindresorhus/globals@v17.5.0...v17.6.0

v17.5.0

• Update globals (2026-04-12) (#342) 5d84602

---

sindresorhus/globals@v17.4.0...v17.5.0

v17.4.0

... (truncated)

Commits

• 8c59927 17.11.0
• 61eafbf Add react-native globals (#337)
• 7bed4af 17.10.0
• f468407 Add GM_cookie to Greasemonkey globals (#349)
• 8e7b935 17.9.0
• 5a958ed Update globals (2026-08-01) (#348)
• 36c7659 17.8.0
• 7394811 Update globals (2026-07-01) (#347)
• a19670c 17.7.0
• 9611620 Update actions (#346)
• Additional commits viewable in compare view

Updates lint-staged from 15.5.2 to 17.4.1

Release notes

Sourced from lint-staged's releases.

v17.4.1

17.4.1

Patch Changes

• #1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.

17.4.0

Minor Changes

• #1836 90ec282 - Added a new defineConfig helper for type-checking the lint-staged configuration:

  // lint-staged.config.ts
  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': ['prettier --check', 'eslint'],
  })

• #1832 510a27c - Added a new flag --all to make lint-staged include all files tracked by Git, instead of only staged.

  By default lint-staged only runs tasks on files that include staged changes (hence the name). Use this flag to include all files tracked in Git version control (standard exclusions apply). Using this flag implies the --no-stash flag, disabling the automatic backup, and the --allow-empty flag so that lint-staged doesn't fail when there are no changes after running. This makes it easier to run npx lint-staged --all on a clean state, for example in CI.

Patch Changes

• #1838 69bec99 - The behavior of the automatic backup stash has been improved when running lint-staged in multiple worktrees in parallel. You should still avoid running multiple instances of lint-staged in parallel in the same tree, because some of the Git operations are locking and might lead to data loss.

• #1839 5e5bdd2 - Parsing of lint-staged CLI flags and Node.js API options has been rewritten to avoid inconsistent behavior between the two.

v17.3.0

Minor Changes

• #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @type {import('./lib/index.js').Configuration} */
  export default {
    "*": [

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.4.1

Patch Changes

• #1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.

17.4.0

Minor Changes

• #1836 90ec282 - Added a new defineConfig helper for type-checking the lint-staged configuration:

  // lint-staged.config.ts
  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': ['prettier --check', 'eslint'],
  })

• #1832 510a27c - Added a new flag --all to make lint-staged include all files tracked by Git, instead of only staged.

  By default lint-staged only runs tasks on files that include staged changes (hence the name). Use this flag to include all files tracked in Git version control (standard exclusions apply). Using this flag implies the --no-stash flag, disabling the automatic backup, and the --allow-empty flag so that lint-staged doesn't fail when there are no changes after running. This makes it easier to run npx lint-staged --all on a clean state, for example in CI.

Patch Changes

• #1838 69bec99 - The behavior of the automatic backup stash has been improved when running lint-staged in multiple worktrees in parallel. You should still avoid running multiple instances of lint-staged in parallel in the same tree, because some of the Git operations are locking and might lead to data loss.

• #1839 5e5bdd2 - Parsing of lint-staged CLI flags and Node.js API options has been rewritten to avoid inconsistent behavior between the two.

17.3.0

Minor Changes

• #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @type {import('./lib/index.js').Configuration} */
  export default {
    '*': [

... (truncated)

Commits

• d0c1517 Merge pull request #1841 from lint-staged/changeset-release/main
• f061335 chore(changeset): release
• d2721af Merge pull request #1840 from lint-staged/updates
• efe5b63 ci: update Changesets action because it failed to publish
• cd76ce3 build: update dependencies
• ea195e1 Merge pull request #1837 from lint-staged/changeset-release/main
• a6a0d61 chore(changeset): release
• 0a09098 Merge pull request #1832 from lint-staged/add-all-flag
• 7fd685b fix: further fix parsing options logic
• 510a27c feat: add --all flag for including all files tracked by Git instead of just...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for lint-staged since your current version.

Updates semantic-release from 24.2.9 to 25.0.9

Release notes

Sourced from semantic-release's releases.

v25.0.9

25.0.9 (2026-08-05)

Bug Fixes

• do not expose the authenticated repository URL in EGITNOPERMISSION errors (#4283) (8d905a5)

v25.0.8

25.0.8 (2026-07-18)

Bug Fixes

• handle potential null values in commit message and gitTags trimming (0a60004)
• hide-sensitive: mask key/auth/webhook env vars (973d763)
• mask sensitive environment variables and improve commit handling (#4252) (1bfdc52)
• prevent template evaluation syntax in branch expansion and tag formatting (f121540)

v25.0.7

25.0.7 (2026-07-13)

Bug Fixes

• argument Injection via repositoryUrl in package.json (#4245) (c46dbda)

v25.0.6

25.0.6 (2026-07-10)

Bug Fixes

• ensure encoded secrets get masked (8e28dd3)

v25.0.5

25.0.5 (2026-06-09)

Bug Fixes

• revert: next (#4200) (db8ffaa)

v25.0.4

25.0.4 (2026-06-09)

Bug Fixes

• code-quality: add missing comma in context object for consistency (493d6cd)

... (truncated)

Commits

• 8d905a5 fix: do not expose the authenticated repository URL in EGITNOPERMISSION error...
• e176eb7 ci(action): update github/codeql-action action to v4.37.6 (#4282)
• d27db1b chore(deps): update dependency js-yaml to v4.3.1 (#4279)
• 55beeac ci(action): update github/codeql-action action to v4.37.5 (#4277)
• 7bf348d chore(deps): update dependency nock to v14.0.17 (#4275)
• 2ec3ba2 chore(deps): update dependency mockserver-client to v7.5.0 (#4274)
• d3b7724 chore(deps): update npm to v12.0.2 (#4273)
• 514dc5f chore(deps): update dependency npm-run-all2 to v9.0.3 (#4271)
• f25b716 ci(action): update github/codeql-action action to v4.37.4 (#4270)
• 1114416 chore: remove 'next version' badge from README (#4265)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for semantic-release since your current version.

Updates conventional-changelog-conventionalcommits from 8.0.0 to 10.4.0

Release notes

Sourced from conventional-changelog-conventionalcommits's releases.

conventional-changelog-conventionalcommits: v10.4.0

Features

• fail loudly when a preset is rendered by an old writer (#1539) (341e3f0), closes #1495

conventional-changelog-conventionalcommits: v10.3.0

Features

• format references in breaking change notes (#1529) (a8ef1ed), closes #631
• group notes by their keyword (#1533) (7be33d4), closes #815

Bug Fixes

• use current host url paths (#1534) (612d368), closes #986

conventional-changelog-conventionalcommits: v10.2.1

Bug Fixes

• point package homepages and docs to documentation website (04796e2)

conventional-changelog-conventionalcommits: v10.2.0

Features

• support changelog preamble partial (#1491) (e93dbe4)

conventional-changelog-conventionalcommits: v10.1.0

Features

• support changelog preamble (#1489) (7d9794f)

conventional-changelog-conventionalcommits: v10.0.0

⚠ BREAKING CHANGES

• the commit type effect property replaces the hidden commit type property and the bumpStrict preset option for controlling changelog visibility and version bumps.

Fixes #1476.

• Handlebars template strings and partial files were replaced with render functions.
• packages now require Node.js 22 or newer.

Features

• replace handlebars templates with render functions (#1477) (55e6716)
• require node 22 (de5e136)
• support commit type effects (#1484) (78761ae)

Bug Fixes

• encode compare URL tags (#1483) (96bf235)
• render non-closing references separately (#1482) (adb2c69)
• sort notes without compare-func (#1487) (dc78285)

... (truncated)

Changelog

Sourced from conventional-changelog-conventionalcommits's changelog.

10.4.0 (2026-08-18)

Features

• fail loudly when a preset is rendered by an old writer (#1539) (341e3f0), closes #1495

10.3.0 (2026-08-10)

Features

• format references in breaking change notes (#1529) (a8ef1ed), closes #631
• group notes by their keyword (#1533) (7be33d4), closes #815

Bug Fixes

• use current host url paths (#1534) (612d368), closes #986

10.2.1 (2026-07-04)

Bug Fixes

• point package homepages and docs to documentation website (04796e2)

10.2.0 (2026-06-27)

Features

• support changelog preamble partial (#1491) (e93dbe4)

10.1.0 (2026-06-27)

Features

• support changelog preamble (#1489) (7d9794f)

10.0.0 (2026-06-26)

⚠ BREAKING CHANGES

• the commit type effect property replaces the hidden commit type property and the bumpStrict preset option for controlling changelog visibility and version bumps.

Fixes #1476.

• Handlebars template strings and partial files were replaced with render functions.
• packages now require Node.js 22 or newer.

Features

• replace handlebars templates with render functions (#1477) (55e6716)
• require node 22 (de5e136)
• support commit type effects (#1484) (78761ae)

... (truncated)

Commits

• 340ad83 chore(release): monorepo release (#1540)
• 341e3f0 feat(conventional-changelog-angular,conventional-changelog-conventionalcommit...
• cbd52fb chore(release): monorepo release (#1530)
• 612d368 fix(conventional-changelog,conventional-changelog-writer,conventional-changel...
• 7be33d4 feat(conventional-changelog-angular,conventional-changelog-conventionalcommit...
• a8ef1ed feat(conventional-changelog-angular,conventional-changelog-conventionalcommit...
• 18332e8 test: remove duplicate repository fields from fixtures (#1527)
• b82a462 chore(release): monorepo release (#1500)
• 04796e2 fix: point package homepages and docs to documentation website
• 69b0d36 chore(release): monorepo release (#1492)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by dangreen, a new releaser for conventional-changelog-conventionalcommits since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Assignees

The following users could not be added as assignees: yama-dev-team. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

✅ Single Commit Policy - COMPLIANT

Status: Policy requirements met • 1 commit • Valid format • Ready for merge

📊 View validation details

📝 Commit Details

• Hash: 22adf5664238f966da701c43099e30323bdb65c5
• Message: deps(deps): bump the major-updates group with 8 updates
• Author: dependabot[bot]

✅ Validation Results

• Single commit requirement met
• No merge commits in branch
• Semantic commit message format verified
• Ready for squash merge to main branch

---

🤖 Automated validation by Yama Single Commit Enforcement

[github-actions]

🤖 AI Review & Build Compliance ✅

Status: AI analysis complete • Build rules validated • Ready for review

📊 View detailed analysis results

🛡️ Analysis Complete

• ✅ Security scan (vulnerabilities, API keys)
• ✅ TypeScript safety & code quality
• ✅ Error handling & best practices
• ✅ Build rule enforcement validated
• ✅ Commit format & compliance checks

📋 Ready for Merge When

• All CI checks passing
• Manual review approved
• Any AI-flagged issues resolved

---

🤖 AI analysis complete - check individual code comments for specific feedback