Skip to content

Bump picomatch, lint-staged and workbox-build - #435

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-01af4b9bce
Open

Bump picomatch, lint-staged and workbox-build#435
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-01af4b9bce

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown
Contributor

Bumps picomatch to 4.0.5 and updates ancestor dependencies picomatch, lint-staged and workbox-build. These dependencies need to be updated together.

Updates picomatch from 4.0.3 to 4.0.5

Release notes

Sourced from picomatch's releases.

4.0.5

What's Changed

New Contributors

Full Changelog: micromatch/picomatch@4.0.4...4.0.5

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits
  • 4f41a8e 4.0.5
  • 02cfc1b Update .verb.md and run verb to generate README documentation
  • cc52ff6 Only run the upload code coverage step for 1 matrix permutation
  • 6d426d7 Allow workflow to continue if the code coverage step to fails
  • a00b954 Merge branch 'codeql-coverage'
  • 9680381 Merge pull request #183 from MerlijnW70/fix/matchbase-windows-basename
  • 648b4f2 Merge pull request #182 from MerlijnW70/fix/repeated-extglob-drops-branches
  • 70e6485 Configure code coverage upload for CodeQL
  • ab8bc4d fix: honor the windows option when matching basenames
  • 6289307 fix: preserve all branches when rewriting risky repeated extglobs
  • Additional commits viewable in compare view

Updates lint-staged from 10.5.4 to 17.2.0

Release notes

Sourced from lint-staged's releases.

v17.2.0

Minor Changes

  • #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

    /** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};

    Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

    Also, native JavaScript/Node.js function tasks won't be chunked at all, when previously they were run multiple times when chunked:

    /** @type {import('lint-staged').Configuration} */
export default {
  "*.js": {
    title: "Log staged JS files to console",
    task: async (files) => {
      console.log("Staged JS files:", files);
    },
  },
};

v17.1.1

Patch Changes

  • #1820 a626a9f - It's now possible to set --max-arg-length=Infinity to effectively disable chunking of tasks based on the number of staged files. The parsing and validation of the numeric CLI options --max-arg-length and --concurrency has been improved.

v17.1.0

Minor Changes

  • #1816 7568d4f - The console output of lint-staged has been simplified so that there's less interactive spinners and more explicit messages like "Started…" -> "Done!". The primary purpose of this was to remove Listr2, a very large dependency.

    Before:

    Size of node_modules/ after installing: 1561.7 kB with 29 packages.

    Fancy interactive spinners, but output dynamically changes:

    ✔ Backed up original state in git stash (0b191303)
✔ Running tasks for staged files...
✔ Staging changes from tasks...
✔ Cleaning up temporary files...

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.2.0

Minor Changes

  • #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

    /** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};

    Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

    Also, native JavaScript/Node.js function tasks won't be chunked at all, when previously they were run multiple times when chunked:

    /** @type {import('lint-staged').Configuration} */
export default {
  "*.js": {
    title: "Log staged JS files to console",
    task: async (files) => {
      console.log("Staged JS files:", files);
    },
  },
};

17.1.1

Patch Changes

  • #1820 a626a9f - It's now possible to set --max-arg-length=Infinity to effectively disable chunking of tasks based on the number of staged files. The parsing and validation of the numeric CLI options --max-arg-length and --concurrency has been improved.

17.1.0

Minor Changes

  • #1816 7568d4f - The console output of lint-staged has been simplified so that there's less interactive spinners and more explicit messages like "Started…" -> "Done!". The primary purpose of this was to remove Listr2, a very large dependency.

    Before:

    Size of node_modules/ after installing: 1561.7 kB with 29 packages.

    Fancy interactive spinners, but output dynamically changes:

    ✔ Backed up original state in git stash (0b191303)
✔ Running tasks for staged files...

... (truncated)

Commits
  • fb540fb Merge pull request #1824 from lint-staged/changeset-release/main
  • dc0a738 chore(changeset): release
  • 60cbb88 Merge pull request #1823 from lint-staged/reimplement-chunk-files
  • 2354dc4 build(deps): update dependencies
  • 0516e7f docs: adjust debug logs
  • e22f6ed style: run oxfmt on README.md
  • 37e8e1a fix: restore chunking of git add command after running tasks
  • 2c75f1d chore: remove unused file
  • ee156cc feat: add improved lazy-chunking of command strings
  • baa7c98 feat: remove current chunkFiles implementation
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for lint-staged since your current version.


Updates workbox-build from 7.4.0 to 7.4.1

Release notes

Sourced from workbox-build's releases.

Workbox v7.4.1

What's Changed

New Contributors

Full Changelog: GoogleChrome/workbox@v7.4.0...v7.4.1

Commits
  • 62b9d8b v7.4.1
  • b6b696c Merge pull request #3510 from GoogleChrome/chore/update-lock-file
  • 6524a7d Update test
  • 9a57e39 Run npm audit fix
  • 86035d8 Update lock file
  • c75363a Merge pull request #3508 from GoogleChrome/dependabot/github_actions/github/c...
  • 85383d6 Merge pull request #3507 from GoogleChrome/dependabot/npm_and_yarn/apideck/be...
  • a1cdb47 Bump github/codeql-action from 4 to 4.35.2
  • 05b276d Bump @​apideck/better-ajv-errors from 0.3.1 to 0.3.7
  • 8e6df29 Merge pull request #3489 from rtritto/replace-lodash
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump picomatch, lint-staged and workbox-build
e8f79af 
Bumps [picomatch](https://github.com/micromatch/picomatch) to 4.0.5 and updates ancestor dependencies [picomatch](https://github.com/micromatch/picomatch), [lint-staged](https://github.com/lint-staged/lint-staged) and [workbox-build](https://github.com/googlechrome/workbox). These dependencies need to be updated together.


Updates `picomatch` from 4.0.3 to 4.0.5
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.5)

Updates `lint-staged` from 10.5.4 to 17.2.0
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v10.5.4...v17.2.0)

Updates `workbox-build` from 7.4.0 to 7.4.1
- [Release notes](https://github.com/googlechrome/workbox/releases)
- [Commits](GoogleChrome/workbox@v7.4.0...v7.4.1)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 4.0.5
  dependency-type: indirect
- dependency-name: lint-staged
  dependency-version: 17.2.0
  dependency-type: direct:development
- dependency-name: workbox-build
  dependency-version: 7.4.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 28, 2026
@cla-assistant

cla-assistant Bot commented Jul 28, 2026

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants