Update dependency commander to v14

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
commander	^12.1.0 → ^14.0.0

---

Release Notes

tj/commander.js (commander)

v14.0.3

Compare Source

Added

• Release Policy document ([#​2462])

Changes

• old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date ([#​2462])
• clarify typing for deprecated callback parameter to .outputHelp() ([#​2427])
• simple readability improvements to README ([#​2465])

v14.0.2

Compare Source

Changed

• improve negative number auto-detection test ([#​2428])
• update (dev) dependencies

v14.0.1

Compare Source

Fixed

• broken markdown link in README ([#​2369])

Changed

• improve code readability by using optional chaining ([#​2394])
• use more idiomatic code with object spread instead of Object.assign() ([#​2395])
• improve code readability using string.endsWith() instead of string.slice() ([#​2396])
• refactor .parseOptions() to process args array in-place ([#​2409])
• change private variadic support routines from ._concatValue() to ._collectValue() (change code from array.concat() to array.push()) ([#​2410])
• update (dev) dependencies

v14.0.0

Compare Source

Added

• support for groups of options and commands in the help using low-level .helpGroup() on Option and Command, and higher-level .optionsGroup() and .commandsGroup() which can be used in chaining way to specify group title for following options/commands ([#​2328])
• support for unescaped negative numbers as option-arguments and command-arguments ([#​2339])
• TypeScript: add parseArg property to Argument class ([#​2359])

Fixed

• remove bogus leading space in help when option has default value but not a description ([#​2348])
• .configureOutput() now makes copy of settings instead of modifying in-place, fixing side-effects ([#​2350])

Changed

• Breaking: Commander 14 requires Node.js v20 or higher
• internal refactor of Help class adding .formatItemList() and .groupItems() methods ([#​2328])

v13.1.0

Compare Source

Added

• support a pair of long option flags to allow a memorable shortened flag, like .option('--ws, --workspace') ([#​2312])

v13.0.0

Compare Source

Added

• support multiple calls to .parse() with default settings ([#​2299])
• add .saveStateBeforeParse() and .restoreStateBeforeParse() for use by subclasses ([#​2299])
• style routines like styleTitle() to add color to help using .configureHelp() or Help subclass ([#​2251])
• color related support in .configureOutput() for getOutHasColors(), getErrHasColors(), and stripColor() ([#​2251])
• Help property for minWidthToWrap ([#​2251])
• Help methods for displayWidth(), boxWrap(), preformatted() et al ([#​2251])

Changed

• Breaking: excess command-arguments cause an error by default, see migration tips ([#​2223])
• Breaking: throw during Option construction for unsupported option flags, like multiple characters after single - ([#​2270])
  • note: support for dual long option flags added in Commander 13.1
• Breaking: throw on multiple calls to .parse() if storeOptionsAsProperties: true ([#​2299])
• TypeScript: include implicit this in parameters for action handler callback ([#​2197])

Deleted

• Breaking: Help.wrap() refactored into formatItem() and boxWrap() ([#​2251])

Migration Tips

Excess command-arguments

It is now an error for the user to specify more command-arguments than are expected. (allowExcessArguments is now false by default.)

Old code:

program.option('-p, --port <number>', 'port number');
program.action((options) => {
  console.log(program.args);
});

Now shows an error:

$ node example.js a b c
error: too many arguments. Expected 0 arguments but got 3.

You can declare the expected arguments. The help will then be more accurate too. Note that declaring
new arguments will change what is passed to the action handler.

program.option('-p, --port <number>', 'port number');
program.argument('[args...]', 'remote command and arguments'); // expecting zero or more arguments
program.action((args, options) => {
  console.log(args);
});

Or you could suppress the error, useful for minimising changes in legacy code.

program.option('-p, --port', 'port number');
program.allowExcessArguments();
program.action((options) => {
  console.log(program.args);
});

Stricter option flag parsing

Commander now throws an error for option flag combinations that are not supported.
In particular, a short flag with multiple characters is now an error.

program.option('-ws, --workspace'); // throws error

A short option has a single character:

program.option('-w, --workspace');

Or from Commander 13.1 you can have an extra long flag instead of a short flag to allow a more memorable shortcut for the full name:

program.option('--ws, --workspace');

---

Configuration

📅 Schedule: Branch creation - "after 7am every weekday,before 7pm every weekday" in timezone CET, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: bun.lock

Command failed: bun install --ignore-scripts
Resolving dependencies
Resolved, downloaded and extracted [1]
error: GET https://repox.jfrog.io/artifactory/api/npm/npm/commander - 401
error: commander@^14.0.0 failed to resolve

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: CLI-259

[sonar-review-alpha]

Summary

⚠️ The PR description exceeded the analysis limit and was truncated. The review may not reflect all context.

This PR updates the commander dependency from v12.1.0 to v14.0.3 via Renovate. It's a straightforward dependency bump with no code changes — only package.json and bun.lock were updated.

Key consideration: Commander v14.0.0 introduced a breaking change requiring Node.js v20 or higher. This project doesn't specify an engines field in package.json, so you should verify your development and deployment environments support Node.js v20+.

The v14.x releases include mostly bugfixes and code quality improvements (better optional chaining, refactored internal methods) with no API changes affecting how the SonarQube CLI uses commander.

What reviewers should know

No code review needed — this is a pure dependency update.

Before merging, verify:

• Your CI/CD pipeline runs on Node.js v20 or higher
• Run the test suite (bun run test:unit, bun run test:all) to confirm the CLI still works correctly with the new version
• The application builds and runs as expected with the updated dependency

Where commander is used: The main CLI uses commander via the SonarCommand class (src/cli/commands/_common/sonar-command.ts) and command definitions in src/cli/command-tree.ts. The API hasn't changed in v14, so these integrations should work without modification.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

LGTM! ✅

🗣️ Give feedback

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud