chore(deps): update dependency commander to v15 - #28
Conversation
|
PR author is in the excluded authors list. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| "chalk": "^5.4.1", | ||
| "cli-table3": "^0.6.5", | ||
| "commander": "^13.1.0", | ||
| "commander": "^15.0.0", |
There was a problem hiding this comment.
🔴 CLI declares support for Node 18 but the upgraded argument parser no longer runs there
The dependency on the command-line parser is raised to a major version that dropped Node 18 support ("commander": "^15.0.0" at package.json:61) while the package still advertises Node 18 compatibility, so users on Node 18 get install-time engine errors or a broken CLI.
Impact: Anyone installing the CLI on Node 18 sees engine warnings/failures and may end up with an unusable command-line tool.
Engine range vs. commander major bump
package.json:49-51 still declares "node": ">=18.0.0". Commander dropped Node 18 in its v14 major (engines ^20.19.0 || >=22.12.0), and v15 continues to require a modern Node. npm will emit EBADENGINE for the transitive requirement, and if it installs anyway, the CLI entry (src/index.ts:1-6, which calls commander's parseAsync) may fail at runtime on Node 18. The engines.node field should be raised to match commander's supported range.
Prompt for agents
package.json bumps commander to ^15.0.0, but commander >=14 requires Node ^20.19.0 || >=22.12.0 while package.json engines still says node >=18.0.0. Update the engines field (and any CI/workflow Node version matrices or docs mentioning Node 18 support) so the declared supported Node range matches what the dependency actually supports, or pin commander to a version that still supports Node 18.
Was this helpful? React with 👍 or 👎 to provide feedback.
| "chalk": "^5.4.1", | ||
| "cli-table3": "^0.6.5", | ||
| "commander": "^13.1.0", | ||
| "commander": "^15.0.0", |
There was a problem hiding this comment.
🟡 Changelog not updated for a user-visible dependency upgrade
The major upgrade of the command-line parser ("commander": "^15.0.0" at package.json:61) is shipped without an entry in the changelog's Unreleased section, which the repository contract requires for user-facing changes.
Impact: Users and maintainers get no record of a change that alters help/error output and supported Node versions.
Repo rule reference
AGENTS.md states: "Conventional Commit titles; update CHANGELOG.md (Unreleased) for user-facing changes." The ## [Unreleased] section of CHANGELOG.md is empty in this PR, even though a commander major bump changes CLI help formatting/error behavior and the minimum Node version.
Prompt for agents
AGENTS.md requires updating CHANGELOG.md's Unreleased section for user-facing changes. Add an entry under ## [Unreleased] noting the commander v13 -> v15 upgrade and any resulting minimum Node version / help output changes.
Was this helpful? React with 👍 or 👎 to provide feedback.
| "chalk": "^5.4.1", | ||
| "cli-table3": "^0.6.5", | ||
| "commander": "^13.1.0", | ||
| "commander": "^15.0.0", |
There was a problem hiding this comment.
🔍 Help output override relies on helpInformation() still being supported
src/cli.ts:163-170 monkey-patches program.helpInformation to prepend the ASCII banner. Commander's help internals were substantially reworked in the v14/v15 majors (help formatting moved further into the Help class, and several help APIs were deprecated/changed). Since only the top-level program is patched, subcommand help never shows the banner anyway; worth verifying against the installed v15 that helpInformation() is still the code path used for --help so the banner keeps working.
Was this helpful? React with 👍 or 👎 to provide feedback.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Risk: medium. Left a non-blocking comment and did not approve because Cursor Security Agent skipped and Cursor Bugbot did not run. Assigned yakimoto for human review of the commander 13→15 major bump.
Sent by Cursor Approval Agent: Pull Request Router and Approver
ApprovabilityVerdict: Needs human review Major commander dependency bump (v15) introduces Node version incompatibility - package.json still declares Node >=18.0.0 but commander v15 requires Node 20+. The author does not own package.json, and there's an unresolved critical finding about this breaking change. You can customize Macroscope's approvability policy. Learn more. |
This PR contains the following updates:
^13.1.0→^15.0.0Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
tj/commander.js (commander)
v15.0.0Compare Source
Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.
The release of Commander 15 moves Commander 14 into maintenance. Commander 14 will get security updates for
12 months (to May 2027). For more info see Release Policy.
Added
Fixed
--no-*option sets default option value totrue, default not implicitly set when define both positive and negative option in either order ([#2405])Changed
require(esm)).node:testtest runner ([#2463])Deleted
commander/esm.mjs([#2464])Migration Tips
Commander 15 is ESM only, but this does not mean you need to migrate to ESM to use it. Importing ESM from CommonJS is
supported by Node.js, and Bun, and Deno. Hopefully it Just Works for you! However, you may be using a different runtime or
some other part of your setup that may not yet natively support importing ESM from CommonJS, such as your testing framework
or bundler.
If you have problems using Commander 15 in your environment, one option is stay on Commander 14 for now. Commander 14 will
get security updates until May 2027 and things will hopefully improve for your setup in the meantime.
v14.0.3Compare Source
Added
Changes
.outputHelp()([#2427])v14.0.2Compare Source
Changed
v14.0.1Compare Source
Fixed
Changed
Object.assign()([#2395])string.endsWith()instead ofstring.slice()([#2396]).parseOptions()to process args array in-place ([#2409])._concatValue()to._collectValue()(change code fromarray.concat()toarray.push()) ([#2410])v14.0.0Compare Source
Added
.helpGroup()onOptionandCommand, and higher-level.optionsGroup()and.commandsGroup()which can be used in chaining way to specify group title for following options/commands ([#2328])parseArgproperty toArgumentclass ([#2359])Fixed
.configureOutput()now makes copy of settings instead of modifying in-place, fixing side-effects ([#2350])Changed
Helpclass adding.formatItemList()and.groupItems()methods ([#2328])Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.Summary by cubic
Upgrade
commanderfrom ^13.1.0 to ^15.0.0. This matters because v15 is ESM-only and changes--no-*option defaults; Node.js 22.12+ is now required.commander; no billing or metering impact.require('commander')withawait import('commander')or migrate the entrypoint to ESM; do not importcommander/esm.mjs.--fooand--no-fooare defined, v15 no longer sets an implicit default. Set explicit defaults where needed and re-check any--no-*flags.cli --help, core commands, and--no-*options).Written for commit 1fcab3a. Summary will update on new commits.