Bump lint-staged from 16.2.0 to 16.2.3 (#853)

Bumps [lint-staged](https://github.com/lint-staged/lint-staged) from 16.2.0 to 16.2.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/lint-staged/lint-staged/releases">lint-staged's releases</a>.</em></p>
<blockquote>
<h2>v16.2.3</h2>
<h3>Patch Changes</h3>
<ul>
<li><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1669">#1669</a> <a href="https://github.com/lint-staged/lint-staged/commit/27cd5413d973baea6b4f3da704fb3bee8298e751"><code>27cd541</code></a> Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! - When using <code>--fail-on-changes</code>, automatically hidden (partially) unstaged changes are no longer counted to make <em>lint-staged</em> fail.</li>
</ul>
<h2>v16.2.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1667">#1667</a> <a href="https://github.com/lint-staged/lint-staged/commit/699f95df8f89ac7f7d360bbf93740d19d5899ac5"><code>699f95d</code></a> Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! - The backup stash will not be dropped when using <code>--fail-on-changes</code> and there are errors. When reverting to original state is disabled (via <code>--no-revert</code> or <code>--fail-on-changes</code>), hidden (partially) unstaged changes are still restored automatically so that it's easier to resolve the situation manually.</p>
<p>Additionally, the example for using the backup stash manually now uses the correct backup hash, if available:</p>
<pre lang="shell"><code>% npx lint-staged --fail-on-changes
✔ Backed up original state in git stash (c18d55a3)
✔ Running tasks for staged files...
✖ Tasks modified files and --fail-on-changes was used!
↓ Cleaning up temporary files...
<p>✖ lint-staged failed because <code>--fail-on-changes</code> was used.</p>
<p>Any lost modifications can be restored from a git stash:</p>
<p>&gt; git stash list --format=&quot;%h %s&quot;
c18d55a3 On main: lint-staged automatic backup
&gt; git apply --index c18d55a3
</code></pre></p>
</li>
</ul>
<h2>v16.2.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1664">#1664</a> <a href="https://github.com/lint-staged/lint-staged/commit/8277b3b298421ebbb39c43d7e3538481e15c4659"><code>8277b3b</code></a> Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! - The built-in TypeScript types have been updated to more closely match the implementation. Notably, the list of staged files supplied to task functions is <code>readonly string[]</code> and can't be mutated. Thanks <a href="https://github.com/outslept"><code>@​outslept</code></a>!</p>
<pre lang="diff"><code>export default {
---  &quot;*&quot;: (files: string[]) =&gt; void console.log('staged files', files)
+++  &quot;*&quot;: (files: readonly string[]) =&gt; void console.log('staged files', files)
}
</code></pre>
</li>
<li>
<p><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1654">#1654</a> <a href="https://github.com/lint-staged/lint-staged/commit/70b9af3ac3fd66af94936e55bb3e91381937b41f"><code>70b9af3</code></a> Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! - This version has been published from GitHub Actions using <a href="https://docs.npmjs.com/trusted-publishers">Trusted Publishing for npm packages</a>.</p>
</li>
<li>
<p><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1659">#1659</a> <a href="https://github.com/lint-staged/lint-staged/commit/49968170abb3bab7ac8dc0a6bc5ea92850337baa"><code>4996817</code></a> Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! - Fix searching configuration files when the working directory is a subdirectory of a git repository, and there are <code>package.json</code> files in the working directory. This situation might happen when running <em>lint-staged</em> for a single package in a monorepo.</p>
</li>
<li>
<p><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1654">#1654</a> <a href="https://github.com/lint-staged/lint-staged/commit/7021f0af40ac1d5787501894c0f2222980023703"><code>7021f0a</code></a> Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! - Return the caret semver range (<code>^</code>) to direct dependencies so that future patch and minor versions are allowed. This enables projects to better maintain and deduplicate their own transitive dependencies while not requiring direct updates to <em>lint-staged</em>. This was changed in <a href="https://github.com/lint-staged/lint-staged/releases/tag/v16.2.0">16.2.0</a> after the vulnerability issues with <code>chalk</code> and <code>debug</code>, which were also removed in the same version.</p>
<p>Given the recent vulnerabilities in the <em>npm</em> ecosystem, it's best to be very careful when updating dependencies.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md">lint-staged's changelog</a>.</em></p>
<blockquote>
<h2>16.2.3</h2>
<h3>Patch Changes</h3>
<ul>
<li><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1669">#1669</a> <a href="https://github.com/lint-staged/lint-staged/commit/27cd5413d973baea6b4f3da704fb3bee8298e751"><code>27cd541</code></a> Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! - When using <code>--fail-on-changes</code>, automatically hidden (partially) unstaged changes are no longer counted to make <em>lint-staged</em> fail.</li>
</ul>
<h2>16.2.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1667">#1667</a> <a href="https://github.com/lint-staged/lint-staged/commit/699f95df8f89ac7f7d360bbf93740d19d5899ac5"><code>699f95d</code></a> Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! - The backup stash will not be dropped when using <code>--fail-on-changes</code> and there are errors. When reverting to original state is disabled (via <code>--no-revert</code> or <code>--fail-on-changes</code>), hidden (partially) unstaged changes are still restored automatically so that it's easier to resolve the situation manually.</p>
<p>Additionally, the example for using the backup stash manually now uses the correct backup hash, if available:</p>
<pre lang="shell"><code>% npx lint-staged --fail-on-changes
✔ Backed up original state in git stash (c18d55a3)
✔ Running tasks for staged files...
✖ Tasks modified files and --fail-on-changes was used!
↓ Cleaning up temporary files...
<p>✖ lint-staged failed because <code>--fail-on-changes</code> was used.</p>
<p>Any lost modifications can be restored from a git stash:</p>
<p>&gt; git stash list --format=&quot;%h %s&quot;
c18d55a3 On main: lint-staged automatic backup
&gt; git apply --index c18d55a3
</code></pre></p>
</li>
</ul>
<h2>16.2.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1664">#1664</a> <a href="https://github.com/lint-staged/lint-staged/commit/8277b3b298421ebbb39c43d7e3538481e15c4659"><code>8277b3b</code></a> Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! - The built-in TypeScript types have been updated to more closely match the implementation. Notably, the list of staged files supplied to task functions is <code>readonly string[]</code> and can't be mutated. Thanks <a href="https://github.com/outslept"><code>@​outslept</code></a>!</p>
<pre lang="diff"><code>export default {
---  &quot;*&quot;: (files: string[]) =&gt; void console.log('staged files', files)
+++  &quot;*&quot;: (files: readonly string[]) =&gt; void console.log('staged files', files)
}
</code></pre>
</li>
<li>
<p><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1654">#1654</a> <a href="https://github.com/lint-staged/lint-staged/commit/70b9af3ac3fd66af94936e55bb3e91381937b41f"><code>70b9af3</code></a> Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! - This version has been published from GitHub Actions using <a href="https://docs.npmjs.com/trusted-publishers">Trusted Publishing for npm packages</a>.</p>
</li>
<li>
<p><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1659">#1659</a> <a href="https://github.com/lint-staged/lint-staged/commit/49968170abb3bab7ac8dc0a6bc5ea92850337baa"><code>4996817</code></a> Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! - Fix searching configuration files when the working directory is a subdirectory of a git repository, and there are <code>package.json</code> files in the working directory. This situation might happen when running <em>lint-staged</em> for a single package in a monorepo.</p>
</li>
<li>
<p><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1654">#1654</a> <a href="https://github.com/lint-staged/lint-staged/commit/7021f0af40ac1d5787501894c0f2222980023703"><code>7021f0a</code></a> Thanks <a href="https://github.com/iiroj"><code>@​iiroj</code></a>! - Return the caret semver range (<code>^</code>) to direct dependencies so that future patch and minor versions are allowed. This enables projects to better maintain and deduplicate their own transitive dependencies while not requiring direct updates to <em>lint-staged</em>. This was changed in <a href="https://github.com/lint-staged/lint-staged/releases/tag/v16.2.0">16.2.0</a> after the vulnerability issues with <code>chalk</code> and <code>debug</code>, which were also removed in the same version.</p>
<p>Given the recent vulnerabilities in the <em>npm</em> ecosystem, it's best to be very careful when updating dependencies.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/lint-staged/lint-staged/commit/bdcd03ae66dde2cb20a1d5b0590e4fd757541346"><code>bdcd03a</code></a> chore(changeset): release</li>
<li><a href="https://github.com/lint-staged/lint-staged/commit/27cd5413d973baea6b4f3da704fb3bee8298e751"><code>27cd541</code></a> fix: do not count hidden (partially) unstaged changes when using `--fail-on-c...</li>
<li><a href="https://github.com/lint-staged/lint-staged/commit/ab2f42e7055a52b4830d7d9d901c6c1cd9706a81"><code>ab2f42e</code></a> fix: emit correct value to debug logs</li>
<li><a href="https://github.com/lint-staged/lint-staged/commit/3fc5832380a8b57780758f861c21992cad711219"><code>3fc5832</code></a> refactor: make general error messages more clear they originate from lint-staged</li>
<li><a href="https://github.com/lint-staged/lint-staged/commit/409d79a3fc15235ffa14e61db07bfa2ac12cd691"><code>409d79a</code></a> chore(changeset): release</li>
<li><a href="https://github.com/lint-staged/lint-staged/commit/7edaee98e9a74a4e0a8646bb452a8139c8563619"><code>7edaee9</code></a> docs: fix typo in changeset</li>
<li><a href="https://github.com/lint-staged/lint-staged/commit/699f95df8f89ac7f7d360bbf93740d19d5899ac5"><code>699f95d</code></a> fix: backup stash example uses real hash if available</li>
<li><a href="https://github.com/lint-staged/lint-staged/commit/47d01a9d45a9a9178b6bf85a7296d62bf542f918"><code>47d01a9</code></a> fix: print backup stash example when failing to <code>--fail-on-changes</code></li>
<li><a href="https://github.com/lint-staged/lint-staged/commit/325dc03f5a6a222556c800cb521d7dba01cb6d41"><code>325dc03</code></a> fix: restore unstaged changes on errors when <code>--fail-on-errors</code> or `--no-reve...</li>
<li><a href="https://github.com/lint-staged/lint-staged/commit/53bb27b0e5c9e140558527f18e729faadc65a748"><code>53bb27b</code></a> fix: do not drop backup stash when errors and <code>--fail-on-changes</code> was used</li>
<li>Additional commits viewable in <a href="https://github.com/lint-staged/lint-staged/compare/v16.2.0...v16.2.3">compare view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by [GitHub Actions](<a href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a> Actions), a new releaser for lint-staged since your current version.</p>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lint-staged&package-manager=npm_and_yarn&previous-version=16.2.0&new-version=16.2.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

Author: dependabot[bot]

package.json

@@ -53,7 +53,7 @@
     "jest": "^30.2.0",
     "jest-junit": "^16.0.0",
     "license-checker-rseidelsohn": "^4.4.2",
-    "lint-staged": "^16.2.0",
+    "lint-staged": "^16.2.3",
     "lodash": "^4.17.21",
     "nodemon": "^3.1.10",
     "prettier": "^3.6.2",

yarn.lock

@@ -920,7 +920,7 @@ __metadata:
     jest: "npm:^30.2.0"
     jest-junit: "npm:^16.0.0"
     license-checker-rseidelsohn: "npm:^4.4.2"
-    lint-staged: "npm:^16.2.0"
+    lint-staged: "npm:^16.2.3"
     lodash: "npm:^4.17.21"
     nodemon: "npm:^3.1.10"
     prettier: "npm:^3.6.2"
@@ -2130,7 +2130,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"commander@npm:14.0.1":
+"commander@npm:^14.0.1":
   version: 14.0.1
   resolution: "commander@npm:14.0.1"
   checksum: 64439c0651ddd01c1d0f48c8f08e97c18a0a1fa693879451f1203ad01132af2c2aa85da24cf0d8e098ab9e6dc385a756be670d2999a3c628ec745c3ec124587b
@@ -4457,24 +4457,24 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lint-staged@npm:^16.2.0":
-  version: 16.2.0
-  resolution: "lint-staged@npm:16.2.0"
+"lint-staged@npm:^16.2.3":
+  version: 16.2.3
+  resolution: "lint-staged@npm:16.2.3"
   dependencies:
-    commander: "npm:14.0.1"
-    listr2: "npm:9.0.4"
-    micromatch: "npm:4.0.8"
-    nano-spawn: "npm:1.0.3"
-    pidtree: "npm:0.6.0"
-    string-argv: "npm:0.3.2"
-    yaml: "npm:2.8.1"
+    commander: "npm:^14.0.1"
+    listr2: "npm:^9.0.4"
+    micromatch: "npm:^4.0.8"
+    nano-spawn: "npm:^1.0.3"
+    pidtree: "npm:^0.6.0"
+    string-argv: "npm:^0.3.2"
+    yaml: "npm:^2.8.1"
   bin:
     lint-staged: bin/lint-staged.js
-  checksum: 0903eea526d390fd04ec10c2b6c3c3accdff53647d1918d3c30236d46fa7714a4a109d1aeda7364ecc689728c7b188bc430911b170834228fe0010d938c9a631
+  checksum: 9b057949f07f78539cd1540402df97b524a2d72d394e535d7c179025014982e4231fb81145fb1763704424d3dfac1184fee5eb4b7fc7d9534fae4106f5bf07d5
   languageName: node
   linkType: hard
 
-"listr2@npm:9.0.4":
+"listr2@npm:^9.0.4":
   version: 9.0.4
   resolution: "listr2@npm:9.0.4"
   dependencies:
@@ -4635,7 +4635,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"micromatch@npm:4.0.8, micromatch@npm:^4.0.8":
+"micromatch@npm:^4.0.8":
   version: 4.0.8
   resolution: "micromatch@npm:4.0.8"
   dependencies:
@@ -4784,7 +4784,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"nano-spawn@npm:1.0.3":
+"nano-spawn@npm:^1.0.3":
   version: 1.0.3
   resolution: "nano-spawn@npm:1.0.3"
   checksum: ea18857e493710a50ded333dd71677953bd9bd9e6a17ade74af957763c50a9a02205ef31bc0d6784f5b3ad82db3d9f47531e9baac2acf01118f9b7c35bd9d5de
@@ -5173,7 +5173,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"pidtree@npm:0.6.0":
+"pidtree@npm:^0.6.0":
   version: 0.6.0
   resolution: "pidtree@npm:0.6.0"
   bin:
@@ -5776,7 +5776,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"string-argv@npm:0.3.2":
+"string-argv@npm:^0.3.2":
   version: 0.3.2
   resolution: "string-argv@npm:0.3.2"
   checksum: 75c02a83759ad1722e040b86823909d9a2fc75d15dd71ec4b537c3560746e33b5f5a07f7332d1e3f88319909f82190843aa2f0a0d8c8d591ec08e93d5b8dec82
@@ -6583,7 +6583,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"yaml@npm:2.8.1, yaml@npm:^2.8.1":
+"yaml@npm:^2.8.1":
   version: 2.8.1
   resolution: "yaml@npm:2.8.1"
   bin: