fix(deps): update external-non-major

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@commitlint/cli (source)	^20.1.0 -> ^20.2.0
@commitlint/config-conventional (source)	^20.0.0 -> ^20.2.0
@types/express (source)	^5.0.5 -> ^5.0.6
express (source)	^5.1.0 -> ^5.2.1
lefthook	^2.0.4 -> ^2.0.8
puppeteer-core (source)	^24.31.0 -> ^24.32.0
turbo (source)	^2.6.1 -> ^2.6.3
ultracite (source)	^6.3.8 -> ^6.3.10

---

Release Notes

conventional-changelog/commitlint (@​commitlint/cli)

v20.2.0

Compare Source

Note: Version bump only for package @​commitlint/cli

conventional-changelog/commitlint (@​commitlint/config-conventional)

v20.2.0

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

expressjs/express (express)

v5.2.1

Compare Source

=======================

• Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

v5.2.0

Compare Source

========================

• Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
• deps: body-parser@^2.2.1
• A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

evilmartians/lefthook (lefthook)

v2.0.8

Compare Source

• fix: do not escape custom templates in command replacement (#​1213) by @​joevin-sql-docto

v2.0.7

Compare Source

• fix: prefer using lefthook from the $PATH (#​1211) by @​joevin-sql-docto

v2.0.6

Compare Source

• feat: save original executable location in hooks (#​1208) by @​mrexox
• docs: encourage python install using pipx (#​1207) by @​franzramadhan

v2.0.5

Compare Source

• feat: add optional args to scripts (#​1206) by @​mrexox
• deps: November 2025 (#​1200) by @​mrexox
• chore: upgrade golangci-lint to 2.6.1, add modernize (#​1190) by @​scop
• chore: publish artifact attestations (#​1189) by @​scop

puppeteer/puppeteer (puppeteer-core)

v24.32.0

Compare Source

🎉 Features

• add browser.screens, .addScreen and .removeScreen methods (#​14445) (98ae5e7)
• bluetooth emulation (#​14448) (e181c1b)
• roll to Chrome 143.0.7499.40 (#​14476) (b0e15af)
• support channel in puppeteer.connect (#​14466) (bc3a521)
• support new page window positioning (#​14446) (20881f8)
• webdriver: bluetooth emulation via WebDriver BiDi (#​14455) (e17263c)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​puppeteer/browsers bumped from 2.10.13 to 2.11.0

🛠️ Fixes

• ignore non-page DevTools targets when handleDevToolsAsPage=true (#​14472) (11bf1d2)
• prevent accessibility nodes attributes with false from being ignored (#​14475) (086a8ab)
• roll to Firefox 145.0.2 (#​14462) (97ca894)
• webdriver: allow for scripts to throw platform objects (#​14456) (7c0d3d9)

vercel/turborepo (turbo)

v2.6.3

Compare Source

v2.6.2

Compare Source

haydenbleasel/ultracite (ultracite)

v6.3.10

Compare Source

Patch Changes

• bc7d89f: Fix nested next.config.ts detection
• d292922: Replace hardcoded npx commands

v6.3.9

Compare Source

Patch Changes

• a13eb72: Add support for Factory Droid AI assistant

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.