chore(deps): bump lint-staged from 16.4.0 to 17.5.0

[dependabot]

Bumps lint-staged from 16.4.0 to 17.5.0.

Release notes

Sourced from lint-staged's releases.

v17.5.0

Minor Changes

• #1847 f9063b7 - Lint-staged now refuses to run when files were staged with --intent-to-add, because Git stash doesn't support them. Previously this was an unhandled error.

Patch Changes

• #1848 d718ccc - Lint-staged now handles color support better in non-TTY streams, and honors the FORCE_COLOR environment variable.

• #1845 7e5ece8 - Update tinyexec@1.3.1 so that local binaries from node_modules/.bin are resolved starting from the directory of each lint-staged configuration file (in monorepo setups). This behavior was broken in lint-staged@16.3.0 where they were only resolved from the current working directory and up.

• #1845 eb8a4e3 - Do not try to restore untracked files when using --hide-all and there is no initial commit yet.

v17.4.1

17.4.1

Patch Changes

• #1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.

17.4.0

Minor Changes

• #1836 90ec282 - Added a new defineConfig helper for type-checking the lint-staged configuration:

  // lint-staged.config.ts
  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': ['prettier --check', 'eslint'],
  })

• #1832 510a27c - Added a new flag --all to make lint-staged include all files tracked by Git, instead of only staged.

  By default lint-staged only runs tasks on files that include staged changes (hence the name). Use this flag to include all files tracked in Git version control (standard exclusions apply). Using this flag implies the --no-stash flag, disabling the automatic backup, and the --allow-empty flag so that lint-staged doesn't fail when there are no changes after running. This makes it easier to run npx lint-staged --all on a clean state, for example in CI.

Patch Changes

• #1838 69bec99 - The behavior of the automatic backup stash has been improved when running lint-staged in multiple worktrees in parallel. You should still avoid running multiple instances of lint-staged in parallel in the same tree, because some of the Git operations are locking and might lead to data loss.

• #1839 5e5bdd2 - Parsing of lint-staged CLI flags and Node.js API options has been rewritten to avoid inconsistent behavior between the two.

v17.3.0

Minor Changes

• #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.5.0

Minor Changes

• #1847 f9063b7 - Lint-staged now refuses to run when files were staged with --intent-to-add, because Git stash doesn't support them. Previously this was an unhandled error.

Patch Changes

• #1848 d718ccc - Lint-staged now handles color support better in non-TTY streams, and honors the FORCE_COLOR environment variable.

• #1845 7e5ece8 - Update tinyexec@1.3.1 so that local binaries from node_modules/.bin are resolved starting from the directory of each lint-staged configuration file (in monorepo setups). This behavior was broken in lint-staged@16.3.0 where they were only resolved from the current working directory and up.

• #1845 eb8a4e3 - Do not try to restore untracked files when using --hide-all and there is no initial commit yet.

17.4.1

Patch Changes

• #1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.

17.4.0

Minor Changes

• #1836 90ec282 - Added a new defineConfig helper for type-checking the lint-staged configuration:

  // lint-staged.config.ts
  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': ['prettier --check', 'eslint'],
  })

• #1832 510a27c - Added a new flag --all to make lint-staged include all files tracked by Git, instead of only staged.

  By default lint-staged only runs tasks on files that include staged changes (hence the name). Use this flag to include all files tracked in Git version control (standard exclusions apply). Using this flag implies the --no-stash flag, disabling the automatic backup, and the --allow-empty flag so that lint-staged doesn't fail when there are no changes after running. This makes it easier to run npx lint-staged --all on a clean state, for example in CI.

Patch Changes

• #1838 69bec99 - The behavior of the automatic backup stash has been improved when running lint-staged in multiple worktrees in parallel. You should still avoid running multiple instances of lint-staged in parallel in the same tree, because some of the Git operations are locking and might lead to data loss.

• #1839 5e5bdd2 - Parsing of lint-staged CLI flags and Node.js API options has been rewritten to avoid inconsistent behavior between the two.

17.3.0

Minor Changes

... (truncated)

Commits

• dcb59f6 Merge pull request #1846 from lint-staged/changeset-release/main
• 9c8c6dc chore(changeset): release
• 586466f Merge pull request #1849 from lint-staged/improve-intent-to-add
• 45eda5f refactor: improve --intent-to-add detection
• 26372e3 Merge pull request #1848 from lint-staged/fix-color-detection
• d718ccc fix: honor FORCE_COLOR/NO_COLOR env variables in non-TTY streams
• be78a51 Merge pull request #1847 from lint-staged/intent-to-add
• f9063b7 feat: refuse to run when files were staged with --intent-to-add
• a767299 Merge pull request #1845 from lint-staged/updates
• 61ffd25 style: add VS Code extension config
• Additional commits viewable in compare view

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/lint-staged	17.5.0	Unknown	Unknown
npm/picomatch	4.0.7	🟢 6.8	Details Check Score Reason Code-Review 🟢 5 Found 7/13 approved changesets -- score normalized to 5 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST 🟢 5 SAST tool is not run on all commits -- score normalized to 5
npm/tinyexec	1.3.1	Unknown	Unknown
npm/yaml	2.9.0	🟢 8	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 7 Found 3/4 approved changesets -- score normalized to 7 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 2 dependency not pinned by hash detected -- score normalized to 2 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• pnpm-lock.yaml

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
app-cf-pages-migration	Error		Sep 1, 2026 7:34am UTC
haotool-app	Ready	Preview	Sep 1, 2026 7:34am UTC