[dependabot]

Bumps the minor-and-patch group with 18 updates in the / directory:

Package	From	To
axios	1.13.5	1.15.2
dayjs	1.11.19	1.11.20
framer-motion	12.34.0	12.38.0
nanoid	5.1.6	5.1.9
react	19.2.4	19.2.5
react-dom	19.2.4	19.2.5
react-hook-form	7.71.1	7.74.0
tailwind-merge	3.4.1	3.5.0
zustand	5.0.11	5.0.12
@commitlint/cli	20.4.1	20.5.2
@commitlint/config-conventional	20.4.1	20.5.0
@types/node	25.2.3	25.6.0
@vitejs/plugin-react-swc	4.2.3	4.3.0
@vitest/coverage-v8	4.0.18	4.1.5
globals	17.3.0	17.5.0
lint-staged	16.2.7	16.4.0
prettier	3.8.1	3.8.3
prettier-plugin-tailwindcss	0.7.2	0.7.3

Updates axios from 1.13.5 to 1.15.2

Release notes

Sourced from axios's releases.

v1.15.2

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

• Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
• SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
• Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

• allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

• Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

• Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

v1.15.1

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

• Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)
• CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)
• Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)
• withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)
• maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)
• Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)
• Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

• AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)
• Location Request Header Type: Adds Location to CommonRequestHeadersList for accurate typing of redirect-aware requests. (#7528)

🐛 Bug Fixes

• FormData Handling: Removes Content-Type when no boundary is present on FormData fetch requests, supports multi-select fields, cancels request.body instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (#7314, #10676, #10702, #10726)
• HTTP Adapter: Handles socket-only request errors without leaking keep-alive listeners. (#10576)
• Progress Events: Clamps loaded to total for computable upload/download progress events. (#7458)
• Types: Aligns runWhen type with the runtime behaviour in InterceptorManager and makes response header keys case-insensitive. (#7529, #10677)
• buildFullPath: Uses strict equality in the base/relative URL check. (#7252)
• AxiosURLSearchParams Regex: Improves the regex used for param serialisation to avoid edge-case mismatches. (#10736)
• Resilient Value Parsing: Parses out header/config values instead of throwing on malformed input. (#10687)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.15.2 - April 21, 2026

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

• Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
• SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
• Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

• allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

• Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

• Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

---

v1.15.1 - April 19, 2026

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

• Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)

• CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)

• Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)

• withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)

• maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)

• Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)

• Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

• AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)

... (truncated)

Commits

• 5829343 chore(release): prepare release 1.15.2 (#10789)
• 4709a48 fix: added fix for memory leak in sockets (#10788)
• be33360 chore: update changelog (#10781)
• 4791514 fix: more header pollutions (#10779)
• 6feafcf fix: socket issue (#10777)
• 302e273 docs: update docs, add a couple actions etc (#10776)
• ac42446 chore(release): prepare release 1.15.1 (#10767)
• 908f220 docs: update threatmodel (#10765)
• f93f815 docs: added docs around potential decompressions bomb (#10763)
• 1728aa1 fix: short-circuits on any truthy non-boolean in withXSRFToken (#10762)
• Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates dayjs from 1.11.19 to 1.11.20

Release notes

Sourced from dayjs's releases.

v1.11.20

1.11.20 (2026-03-12)

Bug Fixes

• Update locale km.js to support meridiem (#3017) (9d2b6a1)
• update updateLocale plugin to merge nested object properties instead of replacing (#3012) (99691c5), closes #1118

Changelog

Sourced from dayjs's changelog.

1.11.20 (2026-03-12)

Bug Fixes

• Update locale km.js to support meridiem (#3017) (9d2b6a1)
• update updateLocale plugin to merge nested object properties instead of replacing (#3012) (99691c5), closes #1118

Commits

• af6e1f8 chore(release): 1.11.20 [skip ci]
• 82babd6 D2M (#3018)
• bbe4ab1 chore: fix lint error
• 99691c5 fix: update updateLocale plugin to merge nested object properties instead of ...
• 9d2b6a1 fix: Update locale km.js to support meridiem (#3017)
• acf21cd chore: update doc
• 55a64e1 chore: update doc
• 807face chore: update doc
• 54f4470 chore: update doc
• 9ea23c7 chore: update doc
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for dayjs since your current version.

Updates framer-motion from 12.34.0 to 12.38.0

Changelog

Sourced from framer-motion's changelog.

[12.38.0] 2026-03-16

Added

• Added layoutAnchor prop to configure custom anchor point for resolving relative projection boxes.

Fixed

• Reorder: Fix axis switching after window resize.
• Reorder: Fix with virtualised lists.
• AnimatePresence: Ensure children are removed when exit animation matches current values.

[12.37.0] 2026-03-16

Added

• Support for hardware accelerating "start" and "end" offsets in scroll and useScroll.
• Support for oklch, oklab, lab, lch, color, color-mix, light-dark color types.

Fixed

• Fix whileInView with client-side navigation.
• Fix draggable elements when layout updates due to surrounding element re-renders.
• Improved memory pressure of layout animations.
• Ensure motion value returned from useSpring reports correct isAnimating().

[12.36.0] 2026-03-09

Added

• Allow dragSnapToOrigin to accept "x" or "y" for per-axis snapping.
• Added axis-locked layout animations with layout="x" and layout="y".
• Added skipInitialAnimation to useSpring.

Fixed

• Fixed height and width: auto animations with box-sizing: border-box.
• Reset component values when exit animation finishes.
• Ensure anticipate easing returns 1 at p === 1.
• Fix @emotion/is-prop-valid resolve error in Storybook.
• Remove data-pop-layout-id from exiting elements when animation interrupted.
• Ensure we skip WAAPI for non-animatable keyframes.
• Ensure we skip WAAPI for SVG transforms.
• Ensure MotionValue props are not passed to SVG.
• AnimatePresence: Prevent mode="wait" elements from getting stuck when switched rapidly.

[12.35.2] 2026-03-09

Fixed

... (truncated)

Commits

• 0bfc9fe v12.38.0
• 343cb0c Updating layoutAnchor
• ee99ad2 Updating changelog
• 062660b Updating changgelog
• 303da7d Updating readme
• b075adc Merge pull request #3647 from motiondivision/feat/layout-anchor
• f0991d6 Add missing layoutAnchor !== false guard in attemptToResolveRelativeTarget
• b5798e9 Merge pull request #3642 from motiondivision/worktree-fix-issue-3078
• 7686c19 Merge pull request #3636 from motiondivision/worktree-fix-issue-3061
• a95c487 Fix auto-scroll in reorder-virtualized test page
• Additional commits viewable in compare view

Updates nanoid from 5.1.6 to 5.1.9

Release notes

Sourced from nanoid's releases.

5.1.9

• Fixed npm package size regression.

5.1.8

• Made cusatomAlphabet 75% faster (by @​saripovdenis).

5.1.7

• Added --version to CLI (by @​mahmoodhamdi).
• Updated nanoid.js for CDN (by @​mahmoodhamdi).
• Fixed docs (by @​mahmoodhamdi).
• Fixed customRandom types (by @​oguimbal).

Changelog

Sourced from nanoid's changelog.

5.1.9

• Fixed npm package size regression.

5.1.8

• Made cusatomAlphabet 75% faster (by @​saripovdenis).

5.1.7

• Added --version to CLI (by @​mahmoodhamdi).
• Updated nanoid.js for CDN (by @​mahmoodhamdi).
• Fixed docs (by @​mahmoodhamdi).
• Fixed customRandom types (by @​oguimbal).

Commits

• e52d946 Release 5.1.9 version
• 2c0eec6 Remove docs from npm package
• 11c05dc Release 5.1.8 version (#586)
• 94953df Fix comment 80 columsn limit (#585)
• e646618 Update benchmark (#584)
• d3030b7 Improve comments (#583)
• e1acf37 Use full byte range in customAlphabet (+ ~75% ops / sec optimisation) (#582)
• f4e7fbe Re-use var in the price of extra 4 bytes of JS bundle size (#581)
• 234a6c3 Remove redundant browser step cast (#578)
• 7720742 Do not calculate expression twice in Node.js where size is not important (#580)
• Additional commits viewable in compare view

Updates react from 19.2.4 to 19.2.5

Release notes

Sourced from react's releases.

19.2.5 (April 8th, 2026)

React Server Components

• Add more cycle protections (#36236 by @​eps1lon and @​unstubbable)

Commits

• 23f4f9f 19.2.5
• See full diff in compare view

Updates react-dom from 19.2.4 to 19.2.5

Release notes

Sourced from react-dom's releases.

19.2.5 (April 8th, 2026)

React Server Components

• Add more cycle protections (#36236 by @​eps1lon and @​unstubbable)

Commits

• 23f4f9f 19.2.5
• See full diff in compare view

Updates react-hook-form from 7.71.1 to 7.74.0

Release notes

Sourced from react-hook-form's releases.

Version 7.74.0

🪇 feat: setValues (#13201)

setValues((data) => {
  return {
    ...data,
    name: 'test'
  }
})
setValues(formValues);

🐞 fix: preserve previous field value when useController name changes (#13395) 🐞 fix: handle null parent when unregistering nested field (#13396) 🐞 fix: treat NaN as empty when valueAsNumber is true in validateField (#13388) 🪢 fix build to exclude test files (#13387)

thanks to @​Yihao-G & @​mixelburg

Version 7.73.1

⚡perf: memoize submit (#13378) 🚉 perf: improve deepEqual performance (#13362) 👀 perf: skip re-render in setValue when value is unchanged (#13352) ✂️ remove unneeded flag check for shouldDirty 🚨 fix: safely access field._f during register (#13365) 🧹 close #13298: improve fieldState errors when resolver uses dot-notation string keys (#13350) 🐞 fix #13178: update state correctly in watch callback with Controller, trigger, and reset (#13180) 🐞 fix #13331: skip field array validation when mode is onBlur (#13333) 🐞 fix #13334 sDirty remains false after deletion an item with shouldDirty: true (#13357) 🐞 fix: handle nested field when parent defaultValue is null (#13348)

thanks to @​Prasadzoman, @​cyphercodes, @​lorenzoceglia, @​rizwan-rizu, @​tomeelog & @​ap0nia

Version 7.72.1

🐞 fix: add isDirty check for numeric string keys in defaultValues (issue #13346) (#13347) 🐞 fix: prevent setValue with shouldDirty from polluting unrelated dirty fields (#13326) 🐞 fix: memoize control in HookFormControlContext to prevent render conflicts (#13272) (#13312) 🐞 fix: isNameInFieldArray should check all ancestor paths for nested field arrays (#13318) 🐞 fix: #13320 formState.isValid incorrect on Controller re-mount (#13324)

thanks to @​6810779s, @​candymask0712, @​olagokemills, @​shahmir-oscilar & @​bae080311

Version 7.72.0

⚓️ feat: built-in form level validate (#13195)

useForm({
  validate: async ({ formValues }: FormValidateResult) => {
</tr></table> 

... (truncated)

Commits

• 8a816ed 7.74.0
• ef641fe 🐞 fix: preserve previous field value when useController name changes (#13395)
• a08a8e8 🐞 fix: handle null parent when unregistering nested field (#13396)
• 2374a64 📖 thanks KANAME for the support over the years
• 6737b99 🌡️ test: cover valueAsNumber NaN required validation in validateField (#13391)
• 29cdd08 🐞 fix: treat NaN as empty when valueAsNumber is true in validateField (#13388)
• 44df01d Revert "Revert "🪢 fix build to exclude test files (#13387)""
• bf525c1 Revert "Revert "🪇 feat: setValues (#13201)""
• 6cd9e45 7.73.1
• 9b07561 Revert "🪢 fix build to exclude test files (#13387)"
• Additional commits viewable in compare view

Updates tailwind-merge from 3.4.1 to 3.5.0

Release notes

Sourced from tailwind-merge's releases.

v3.5.0

New Features

• Add support for Tailwind CSS v4.2 by @​dcastil in dcastil/tailwind-merge#651

Full Changelog: dcastil/tailwind-merge@v3.4.1...v3.5.0

Thanks to @​brandonmcconnell, @​manavm1990, @​langy, @​roboflow, @​syntaxfm, @​getsentry, @​codecov, a private sponsor, @​block, @​openclaw, @​sourcegraph and more via @​thnxdev for sponsoring tailwind-merge! ❤️

Commits

• 270ac79 v3.5.0
• 86f772e add changelog for 3.5.0
• 6c1f77c Merge pull request #651 from dcastil/feature/add-support-for-tailwind-css-v4.2
• 7a4cacf Add support for decimal fraction values
• 9ef0f79 fix incorrectly escaped characters
• f4938b0 update README with v4.2 support
• b02a572 Add Tailwind v4.2 font-features utilities support
• 5bd25ec Add Tailwind v4.2 logical sizing utilities
• 697c920 Add Tailwind v4.2 logical border block utilities
• 6656a47 Improve JSDoc comments for logical insets
• Additional commits viewable in compare view

Updates zustand from 5.0.11 to 5.0.12

Release notes

Sourced from zustand's releases.

v5.0.12

Two small fixes.

What's Changed

• fix(persist): use latest state in post-rehydration callback by @​Shohjahon-n in pmndrs/zustand#3391
• fix(devtools): correct redux devtools config type extension by @​grigoriy-reshetniak in pmndrs/zustand#3414

New Contributors

• @​pavan-sh made their first contribution in pmndrs/zustand#3378
• @​Copilot made their first contribution in pmndrs/zustand#3395
• @​Aravindsreeni made their first contribution in pmndrs/zustand#3400
• @​wallzero made their first contribution in pmndrs/zustand#3401
• @​chaesunbak made their first contribution in pmndrs/zustand#3405
• @​Shohjahon-n made their first contribution in pmndrs/zustand#3391

Full Changelog: pmndrs/zustand@v5.0.11...v5.0.12

Commits

• 206012d 5.0.12
• d714065 chore(deps): update dev dependencies (#3427)
• 89ebcd7 fix(devtools): correct redux devtools config type extension (#3414)
• 6213fc1 fix(persist): use latest state in post-rehydration callback (#3391)
• a3869ca docs: fix broken links in beginner TypeScript guide (#3423)
• c49df38 Hotfix section linking (#3410)
• 5561e9b Fix indentation for actions in index.md (#3406)
• 4966a15 fix(readme) : comparison documentaion link (#3405)
• da381c3 Fix README internal links for GitHub rendering (#3403)
• 0d250b3 fix persist documentation link (#3401)
• Additional commits viewable in compare view

Updates @commitlint/cli from 20.4.1 to 20.5.2

Release notes

Sourced from @​commitlint/cli's releases.

v20.5.2

20.5.2 (2026-04-25)

Just minor dep updates before the next breaking change

Chore & Docs

• chore: remove codesandbox ci integration by @​escapedcat in conventional-changelog/commitlint#4680
• docs: add Windows UTF-8 encoding note to getting started guide by @​Chessing234 in conventional-changelog/commitlint#4699
• docs: improve parserPreset documentation with examples and options reference by @​Chessing234 in conventional-changelog/commitlint#4700
• docs: fix subject-case rule default from 'always' to 'never' by @​Chessing234 in conventional-changelog/commitlint#4703

New Contributors

• @​Chessing234 made their first contribution in conventional-changelog/commitlint#4699

Full Changelog: conventional-changelog/commitlint@v20.5.1...v20.5.2

v20.5.1

20.5.1 (2026-03-31)

Bug Fixes

• fix(cz-commitlint): add VS16 to single character emojis by @​mrt181 in conventional-changelog/commitlint#4666
• fix(cz-commitlint): handle modifiers correctly by @​mrt181 in conventional-changelog/commitlint#4667

Reverts

• Revert "fix: update dependency global-directory to v5 (#4671)" by @​escapedcat in conventional-changelog/commitlint#4677

Core & co

• chore: deps and CI improvements by @​escapedcat in conventional-changelog/commitlint#4660
• ci: restore push on all branches, avoid duplicate runs by @​escapedcat in conventional-changelog/commitlint#4665

Full Changelog: conventional-changelog/commitlint@v20.5.0...v20.5.1

v20.5.0

20.5.0 (2026-03-15)

Bug Fixes

• fix(resolve-extends): always resolve extended parser presets for proper merging by @​omar-y-abdi in conventional-changelog/commitlint#4647

... (truncated)

Changelog

Sourced from @​commitlint/cli's changelog.

20.5.2 (2026-04-25)

Note: Version bump only for package @​commitlint/cli

20.5.0 (2026-03-15)

Bug Fixes

• cli: validate that --cwd directory exists before execution (#4658) (cf80f75), closes #4595

20.4.4 (2026-03-12)

Note: Version bump only for package @​commitlint/cli

20.4.3 (2026-03-03)

Bug Fixes

• footer parser does not escape special chars for regex #4560 (#4634) (8ff7c7f)

20.4.2 (2026-02-19)

Note: Version bump only for package @​commitlint/cli

Commits

• 7fe86b2 v20.5.2
• a7918e9 v20.5.0
• cf80f75 fix(cli): validate that --cwd directory exists before execution (#4658)
• 02d7245 v20.4.4
• a746981 v20.4.3
• 18bd371 chore: deps (#4635)
• 8ff7c7f fix: footer parser does not escape special chars for regex #4560 (#4634)
• 81cfc9e v20.4.2
• See full diff in compare view

Updates @commitlint/config-conventional from 20.4.1 to 20.5.0

Release notes

Sourced from @​commitlint/config-conventional's releases.

v20.5.0

20.5.0 (2026-03-15)

Bug Fixes

• fix(resolve-extends): always resolve extended parser presets for proper merging by @​omar-y-abdi in conventional-changelog/commitlint#4647
• fix(load): resolve async config exports in CJS projects by @​omar-y-abdi in conventional-changelog/commitlint#4659
• fix(cli): validate that --cwd directory exists before execution by @​omar-y-abdi in conventional-changelog/commitlint#4658

Features

• feat(cz-commitlint): add exclamation mark support for breaking changes by @​mrt181 in conventional-changelog/commitlint#4655

New Contributors

• @​mrt181 made their first contribution in conventional-changelog/commitlint#4655
• @​omar-y-abdi made their first contribution in conventional-changelog/commitlint#4647

Full Changelog: conventional-changelog/commitlint@v20.4.4...v20.5.0

v20.4.4

20.4.4 (2026-03-12)

Bug Fixes

• fix(types): allow context parameter in QualifiedRuleConfig functions by @​Br1an67 in conventional-changelog/commitlint#4636
• fix(read): update git-raw-commits to v5 API by @​Tamas-hi in conventional-changelog/commitlint#4638
• fix(is-ignored): strip CI skip markers from release commits by @​Br1an67 in conventional-changelog/commitlint#4637

New Contributors

• @​Br1an67 made their first contribution in conventional-changelog/commitlint#4636
• @​Tamas-hi made their first contribution in conventional-changelog/commitlint#4638

Full Changelog: conventional-changelog/commitlint@v20.4.3...v20.4.4

v20.4.3

20.4.3 (2026-03-03)

Bug Fixes

• fix: npx usage #613 by @​escapedcat in conventional-changelog/commitlint#4630
• fix(types): incorrect types for rule options by @​Zamiell in conventional-changelog/commitlint#4633

... (truncated)

Changelog

Sourced from @​commitlint/config-conventional's changelog.

20.5.0 (2026-03-15)

Note: Version bump only for package @​commitlint/config-conventional

20.4.4 (2026-03-12)

Note: Version bump only for package @​commitlint/config-conventional

20.4.3 (2026-03-03)

Bug Fixes

• footer parser does not escape special chars for regex #4560 (#4634) (8ff7c7f)

20.4.2 (2026-02-19)

Note: Version bump only for package @​commitlint/config-conventional

Commits

• a7918e9 v20.5.0
• 02d7245 v20.4.4
• a746981 v20.4...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.