chore(deps): update dependency conf to v15

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
conf	^13.1.0 → ^15.0.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

sindresorhus/conf (conf)

v15.1.0

Compare Source

• Add encryptionAlgorithm option ee03ae8

---

v15.0.2

Compare Source

• Fix build 6287608

---

v15.0.1

Compare Source

• Fix handling of legacy decryption (#​204) ce28bd6

---

v15.0.0

Compare Source

There are no known breaking changes, but it's a major release since it contains a large refactor, and that introduces risk.

• Add .appendToArray() method a1dbf86
• Fix constructor validation preventing migrations from fixing invalid schema data a1b43e6
• Fix clear() method to emit single change event 9b83a9d
• Fix store setter to preserve internal migration data ceefe13

---

v14.0.0

Compare Source

Breaking

• Require Node.js 20 b8cc931

Improvements

• Add TypeScript type definitions for dot notation property access (#​200) 83cb242

---

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[greptile-apps]

PR author is in the excluded authors list.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR is limited to package metadata and a lockfile, with no new source capability or schema change. Because it upgrades a production dependency across a major version with changed engine requirements, and the modified files are owned by the core team rather than the author, compatibility should receive human review.

Not approved because:

• Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	conf@​13.1.0 ⏵ 15.1.0	+1		+1

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[codeant-ai]

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.

[codeant-ai]

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.

[yakimoto]

Flagging a blocker that does not show up in the checks on this PR: it is green, but it would ship a broken install for part of the declared support range.

$ npm view conf@15 engines --json
{ "node": ">=20" }

$ git show origin/main:package.json   # engines
{ "node": ">=18.0.0" }

conf is a runtime dependency, so a user on Node 18 or 19 installs this successfully — npm only warns on an engines mismatch, it does not fail — and then hits the failure when the CLI actually runs. Nothing in CI catches it because no job installs the package under the oldest supported Node.

This is the same conflict already flagged on the sibling bumps, and it should be decided once rather than three times:

PR	package	requires	vs declared >=18.0.0
#29 (this)	conf@15	>=20	excludes 18, 19
#27	chalk@6	>=22	excludes 18-21
#28	commander@15	>=22.12.0	excludes 18-22.11

Two honest resolutions:

1. Raise engines.node to the highest floor being adopted and record it under Unreleased in CHANGELOG.md as a breaking change (AGENTS.md:13 requires this for user-facing changes). Node 18 and 20 are both past end-of-life, so this is defensible.
2. Hold these dependencies at their current majors, which support the existing floor.

Marking not-ready pending that decision, since the support policy is a maintainer call rather than something a dependency bump should settle on its own. Worth noting this PR is the easiest of the three to merge by accident — it is CLEAN with no review threads, so nothing on the PR surfaces the conflict.