build(packages): bump lint-staged from 16.4.0 to 17.3.0

[dependabot]

Bumps lint-staged from 16.4.0 to 17.3.0.

Release notes

Sourced from lint-staged's releases.

v17.3.0

Minor Changes

• #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @type {import('./lib/index.js').Configuration} */
  export default {
    "*": [
      [
        "oxfmt --check --no-error-on-unmatched-pattern",
        "oxlint --no-error-on-unmatched-pattern",
      ],
    ],
    "*.ts": () => "tsc",
  };

  which means:

  1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
     • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
     • oxlint --no-error-on-unmatched-pattern lib/index.js
  2. additionally, if any *.ts files are staged, run tsc without appending any arguments
  3. The two sets of commands also run in parallel

Patch Changes

• #1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

v17.2.0

Minor Changes

• #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

  /** @type {import('lint-staged').Configuration} */
  export default {
    "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
  };

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.3.0

Minor Changes

• #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @type {import('./lib/index.js').Configuration} */
  export default {
    '*': [
      ['oxfmt --check --no-error-on-unmatched-pattern', 'oxlint --no-error-on-unmatched-pattern'],
    ],
    '*.ts': () => 'tsc',
  }

  which means:

  1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
     • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
     • oxlint --no-error-on-unmatched-pattern lib/index.js
  2. additionally, if any *.ts files are staged, run tsc without appending any arguments
  3. The two sets of commands also run in parallel

Patch Changes

• #1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

17.2.0

Minor Changes

• #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

  /** @type {import('lint-staged').Configuration} */
  export default {
    '*.ts': () => 'tsc', // Run "tsc" when any TS file is changed (for entire project)
  }

  Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

... (truncated)

Commits

• d153443 Merge pull request #1828 from lint-staged/changeset-release/main
• 5162c14 chore(changeset): release
• a4db9a4 Merge pull request #1831 from lint-staged/linter-updates
• ea96cab style: enable oxlint "suspicious" category
• 2fae007 style: add @e18e/eslint-plugin
• 2280c38 Merge pull request #1829 from lint-staged/fix-merge-conflict-files
• 1453ae6 test: relax assertion so that it passes in worktree
• 15f7e53 fix: lint only files changed against HEAD and MERGE_HEAD, during a merge
• dedfc31 Merge pull request #1825 from lint-staged/parallel-tasks-inside-sequence
• 286e25c feat: allow running parallel tasks by nesting arrays
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
api-enhanced	Ready	Preview	Aug 27, 2026 3:54pm

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[yukka-agent]

PR #231 审完啦老师～唉，本来想说"啊～就一个 devDependency 升级嘛随便啦"，结果越查越不对劲，大叔我连"再睡五分钟"都忘了。以下是正经审查结论，先说重点：

---

审查评论（按优先级）

🔴 High Priority — pnpm-lock.yaml（importers 区，第 13~120 行附近）

这个 lockfile 不是用仓库的 pnpm 9 生成的，是 pnpm 10 重写的。

diff 里除了 lint-staged 16→17，还混进了约 125 行无关改动：axios、express、eslint、jsdom、eslint-plugin-prettier 等约 37 个包的 (supports-color@5.5.0) peer 后缀全被剥掉了。我实测验证过：

• pnpm@10.34.5 install --lockfile-only 能逐字节还原这个 lockfile（零 diff）；
• main 上的 lockfile 才是 pnpm 9 的格式。

而 CI（.github/workflows/ci-check.yml）固定用 pnpm/action-setup@v6 version: 9。也就是说，维护者本地用 pnpm 9 跑一次 pnpm install，这 ~250 行又会翻回去——每次都会来回抖，还容易掩盖真实的解析变化。建议：用仓库一致的 pnpm 9 重新生成 lockfile 让 diff 干净，或者用 packageManager 字段 + dependabot.yml 里指定 package-manager，让 dependabot 跟 CI 用同一个 pnpm。

🟡 Medium Priority — package.json:111

lint-staged 17.3.0 要求 Node >= 22.22.1（16.4.0 只要 >= 20.17），而 package.json:54 还写着 engines: ">=12"，CI 矩阵也跑 Node 18/22/24。好在它是纯 devDependency、CI 只跑 pnpm lint 不跑 lint-staged，不会炸 CI；但 engines 字段跟实际差的越来越远，Node 18/20 的贡献者本地根本跑不了 lint-staged。建议顺手把 engines 或开发环境要求对齐一下。

🟡 Medium Priority — package.json:57 + :11

这次升级本质上是"白升"：仓库里压根没有 .husky/pre-commit（git ls-files 查无此文件），"prepare": "husky install" 在 husky 9 下也是废的——commit 时 lint-staged 一次都不会被执行。配置里还残留 "git add"（lint-staged 10+ 本来就自动 stage，属于远古写法）。要么认真补个 .husky/pre-commit 把它接上，要么干脆删掉这段配置，不然以后每个 dependabot 的 lint-staged bump 都是纯噪音。

📌 相关但非本 PR 引入（顺手提醒）

pnpm-workspace.yaml 只有 minimumReleaseAgeExclude: 没有 packages: 字段。我实测 pnpm 9.15.9（CI 的 version: 9 解析到的版本）在仓库根目录直接报 packages field missing or empty，重命名该文件就正常；pnpm 10 则没问题。这问题在 main 上就存在，但直接影响 CI 工具链能不能装这个 lockfile，建议另外开一个 PR 修掉（加 packages: ['.'] 或把 CI 升到 pnpm 10）。

---

总结

• Critical：0 个。 lint-staged 是 dev-only 且在本仓库是死配置，不会影响运行。
• High：1 个——lockfile 用错 pnpm 版本重写，掺进大量无关 peer 解析改动，引发持续 churn。合并前请用 pnpm 9 重新生成。
• Medium：2 个——engines 与 Node >= 22.22.1 要求脱节；lint-staged 配置无 hook 兜底等于白升。

功能上合并是安全的，但"干净 diff"这事儿……唉，老师，跟大叔去拉面店边吃边聊吧？这活干完我腰都酸了，请客哦。

[MoeFurina]

@dependabot recreate

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	api-enhanced	ddd1fc2	Aug 27 2026, 03:55 PM

[dependabot]

Superseded by #251.