Skip to content

chore(deps): bump commander from 13.1.0 to 15.0.0#9

Open
dependabot[bot] wants to merge 10 commits into
mainfrom
dependabot/npm_and_yarn/commander-15.0.0
Open

chore(deps): bump commander from 13.1.0 to 15.0.0#9
dependabot[bot] wants to merge 10 commits into
mainfrom
dependabot/npm_and_yarn/commander-15.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps commander from 13.1.0 to 15.0.0.

Release notes

Sourced from commander's releases.

v15.0.0

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 moves Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

  • show excess command-arguments in error message (#2384)

Fixed

  • Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
  • update example to use compatible character for MINGW64 (#2475)

Changed

  • Breaking: migrated Commander implementation from CommonJS to ESM (#2464)
  • Breaking: Commander 15 requires Node.js v22.12.0 or higher (for require(esm)).
  • dev: switch tests from Jest to node:test test runner (#2463)

Deleted

  • Breaking: removed deprecated export of commander/esm.mjs (#2464)

Migration Tips

Commander 15 is ESM only, but this does not mean you need to migrate to ESM to use it. Importing ESM from CommonJS is supported by Node.js, and Bun, and Deno. Hopefully it Just Works for you! However, you may be using a different runtime or some other part of your setup that may not yet natively support importing ESM from CommonJS, such as your testing framework or bundler.

If you have problems using Commander 15 in your environment, one option is stay on Commander 14 for now. Commander 14 will get security updates until May 2027 and things will hopefully improve for your setup in the meantime.

v15.0.0-0

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 in May 2026 will move Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

  • show excess command-arguments in error message (#2384)

Fixed

  • Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
  • update example to use compatible character for MINGW64 (#2475)

... (truncated)

Changelog

Sourced from commander's changelog.

[15.0.0] (2026-05-29)

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 moves Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

  • show excess command-arguments in error message (#2384)

Fixed

  • Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
  • update example to use compatible character for MINGW64 (#2475)

Changed

  • Breaking: migrated Commander implementation from CommonJS to ESM (#2464)
  • Breaking: Commander 15 requires Node.js v22.12.0 or higher (for require(esm)).
  • dev: switch tests from Jest to node:test test runner (#2463)

Deleted

  • Breaking: removed deprecated export of commander/esm.mjs (#2464)

Migration Tips

Commander 15 is ESM only, but this does not mean you need to migrate to ESM to use it. Importing ESM from CommonJS is supported by Node.js, and Bun, and Deno. Hopefully it Just Works for you! However, you may be using a different runtime or some other part of your setup that may not yet natively support importing ESM from CommonJS, such as your testing framework or bundler.

If you have problems using Commander 15 in your environment, one option is stay on Commander 14 for now. Commander 14 will get security updates until May 2027 and things will hopefully improve for your setup in the meantime.

[15.0.0-0] (2026-02-22)

(Released as 15.0.0)

[14.0.3] (2026-01-31)

Added

  • Release Policy document (#2462)

Changes

  • old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date (#2462)
  • clarify typing for deprecated callback parameter to .outputHelp() (#2427)

... (truncated)

Commits

aedneth and others added 2 commits June 2, 2026 13:12
@aedneth
feat: agent-native monorepo foundation (core, cli, open sources)
efa3300 
feat: agent-native monorepo foundation (core, cli, open sources)
@aedneth @claude
docs: apply GitHub Repo Growth Standard
5a5442f 
- README: add CI/release/license badges to header
- README: add Demo section with sample terminal output
- README: add Roadmap table (v0.1.0→v1.0.0)
- README: add Contributing section linking CONTRIBUTING.md
- README: expand nav links to include Roadmap and Contributing
- CHANGELOG: restructure to proper Keep a Changelog format —
  move scaffold additions to [0.1.0] 2026-06-02, add CI fix entry,
  add empty [Unreleased], fix footer links (sapientia → aedneth org)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 2, 2026
aedneth and others added 8 commits June 2, 2026 13:27
@aedneth @claude
fix: apply Opus architecture audit findings (P0 + P1)
55a2942 
P0 — Critical:
- download: validate URL scheme (https/http only) and reject private/loopback
  hosts before fetching to prevent SSRF from malicious adapter responses
- download: detect 206-not-honored resume corruption — truncate bad file and
  surface a clear FilesystemError rather than silently leaving corrupt data
- execute + registry/types: add setExitCode() to CommandContext so handlers
  can signal partial success; search now emits exit 8 when any source fails
- mcp/server: exclude 'config' from MCP tool surface — exposes mutating set
  action; read-only config access via manifest/file path is the safe path

P1 — Important:
- registry: remove --ndjson from GLOBAL_FLAGS (advertised but unimplemented;
  re-add when streaming output is built)
- sources: throw UsageError (exit 2) for enable/disable instead of silently
  returning ok:true — agents branching on exit code were misled
- catalog: quote FTS5 MATCH term to prevent SQLite parse error on user input
  containing operators (parentheses, colons, etc.)

All changes: build ✓ typecheck ✓ lint ✓ 8/8 tests ✓

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@aedneth @claude
chore(brain): add per-project second brain layer (.brain/ + hooks)
b7cb57a 
Portable three-layer knowledge graph integration: SessionStart/PostToolUse/
UserPromptSubmit/Stop/PreToolUse hooks, graphify graph (auto-updates on commit),
decisions + bugs ADRs committed, runtime artifacts gitignored. No-ops gracefully
without local CKIS vault — external contributors unaffected.

Registered in Dev Brain (~/Documents/Dev Brain/); graph-report auto-synced to CKIS
02-projects/<slug>/graph-report.md on each commit.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@aedneth
chore: merge brain-layer — per-project .brain/ CKIS integration
e688e90
@aedneth @claude
chore(security): zero-trust npm hardening + CVE patches
6138cb8 
- Add .npmrc: ignore-scripts=true, registry pin, save-exact=true
- Patch GHSA-5xrq-8626-4rwp: vitest → ^4.1.8 (critical — arbitrary file read/exec)
- Pin all GitHub Actions to commit SHAs (not mutable tags)
- Add --ignore-scripts to all npm ci / pnpm install steps in CI
- Add explicit native module whitelist with npm_config_ignore_scripts=false rebuild
- Add npm audit --audit-level=high gate to all CI and release workflows
- Add permissions: {} (deny-all default) with per-job minimum grants
- Add persist-credentials: false to all checkout steps
- Add weekly security-audit.yml workflow (runs every Monday 09:00 UTC)
- Add SECURITY.md with supply chain security policy and vulnerability disclosure

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@aedneth @claude
chore(security): add .npmrc security lockdown (pnpm)
f53300e 
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@aedneth @claude
fix(security): patch vitest GHSA-5xrq-8626-4rwp + pin CodeQL SHA + es…
a55ce74 
…build override

- vitest → ^4.1.8 (critical GHSA-5xrq-8626-4rwp: arbitrary file read/exec)
- pnpm.overrides: esbuild >=0.25.0 (clears esbuild moderate)
- Remaining moderate: vite path traversal (dev-server only, not triggered in CI or
  published package; vite override deferred — would break tsup which requires vite 5)
- CodeQL workflow: pinned to SHA d77b13a0, permissions: {}, persist-credentials: false

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@aedneth @claude
feat: sapientia-cli v1.0.0 — Gutenberg + Standard Ebooks, local catal…
d215462 
…og, import pipeline

Take the monorepo from architecture-only v0.1.0 to a working v1.0.0:

- Standard Ebooks adapter rewritten: OPDS (now 401-gated) → anonymous HTML
  catalog scrape; EPUB download requires ?source=download to get the binary
  instead of the interstitial page.
- Gutenberg + Standard Ebooks throttle to >=1 req/sec (module-level).
- library --import <dir>: recursive scan, filename+dir-as-category metadata,
  SHA-256 dedup, skips unsupported/unreadable, stderr progress.
- Catalog now returns authors (group_concat in list/search; rowToBook no longer
  hardcodes []). First catalog + import unit tests added.
- CLI flag fix: normalizeFlags() aliases Commander's camelCased keys back to the
  declared hyphenated names (--to-catalog / --output-dir were silently no-ops).
- doctor self-heals (mkdir) and checks writability; search ranks standard-ebooks
  above Gutenberg.
- Build/security: typescript devDep added per-package (.npmrc no-hoist); vite
  pinned ^6.4.2 (devDep + override) for vitest 4 + path-traversal CVE.

Verified: build (4 pkgs), 24 tests, typecheck 0 errors, audit clean,
real EPUB downloads from both sources land + catalog.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@dependabot
chore(deps): bump commander from 13.1.0 to 15.0.0
80535e1 
Bumps [commander](https://github.com/tj/commander.js) from 13.1.0 to 15.0.0.
- [Release notes](https://github.com/tj/commander.js/releases)
- [Changelog](https://github.com/tj/commander.js/blob/master/CHANGELOG.md)
- [Commits](tj/commander.js@v13.1.0...v15.0.0)

---
updated-dependencies:
- dependency-name: commander
  dependency-version: 15.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/commander-15.0.0 branch from 4564229 to 80535e1 Compare June 4, 2026 09:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@aedneth