chore(deps): update weekly dependencies (major)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
@actions/core (source)	^1.11.1 → ^3.0.0					dependencies	major
@actions/exec (source)	^1.1.1 → ^3.0.0					dependencies	major
@actions/github (source)	^6.0.0 → ^9.0.0					dependencies	major
@clack/prompts (source)	^0.11.0 → ^1.0.0					dependencies	major
@clack/prompts (source)	^0.11.0 → ^1.0.0					devDependencies	major
@commitlint/cli (source)	^19.0.0 → ^20.0.0					devDependencies	major
@commitlint/config-angular (source)	^19.0.0 → ^20.0.0					devDependencies	major
@commitlint/config-conventional (source)	^19.0.0 → ^20.0.0					devDependencies	major
@eslint/compat (source)	^1.1.1 → ^2.0.0					devDependencies	major
@eslint/eslintrc	^2.1.1 → ^3.0.0					devDependencies	major
@eslint/js (source)	^9.8.0 → ^10.0.0					devDependencies	major
@evilmartians/lefthook	^1.8.0 → ^2.0.0					devDependencies	major
@hookform/resolvers (source)	^4.1.3 → ^5.0.0					dependencies	major
@infisical/sdk	^4.0.6 → ^5.0.0					dependencies	major
@ngneat/falso	^7.3.0 → ^8.0.0					dependencies	major
@octokit/core	6.1.6 → 7.0.6					devDependencies	major
@octokit/plugin-rest-endpoint-methods	^13.2.6 → ^17.0.0					devDependencies	major
@octokit/types	^13.6.1 → ^16.0.0					devDependencies	major
@types/mime-types (source)	^2.1.4 → ^3.0.0					devDependencies	major
@types/node (source)	22.19.3 → 24.12.0					devDependencies	major
@types/nodemailer (source)	^6.4.17 → ^7.0.0					devDependencies	major
@types/supertest (source)	^6.0.2 → ^7.0.0					devDependencies	major
actions/cache	v4 → v5					action	major
actions/checkout	v4 → v6					action	major
actions/create-github-app-token	v1 → v3					action	major
actions/download-artifact	v4 → v8					action	major
actions/github-script	v7 → v8					action	major
actions/setup-node	v4 → v6					action	major
actions/upload-artifact	v4 → v7					action	major
codecov/codecov-action	v5 → v6					action	major
dotenv	^16.4.7 → ^17.0.0					devDependencies	major
dotenv-expand	^11.0.7 → ^12.0.0					devDependencies	major
eslint-plugin-react-hooks (source)	5.2.0 → 7.0.1					devDependencies	major
is-ci	^3.0.1 → ^4.0.0					devDependencies	major
isbot (source)	^4.4.0 → ^5.0.0					dependencies	major
jsdom	~26.1.0 → ~29.0.0					devDependencies	major
jsonc-eslint-parser	2.4.2 → 3.1.0					dependencies	major
lucide-react (source)	^0.562.0 → ^1.0.0					dependencies	major
node (source)	20.19.6 → 24.14.1						major
node (source)	>=20 <22 → >=20 <25					engines	major
node	20 → 24					uses-with	major
node	20-alpine → 24-alpine					final	major
node	22.11.0-slim → 24.14.1-slim					final	major
node	20-bullseye-slim → 24-bullseye-slim					final	major
nrwl/nx-set-shas	v4 → v5					action	major
pnpm (source)	9.15.9 → 10.33.0					packageManager	major
pnpm/action-setup	v4 → v5					action	major
tailwind-merge	^2.3.0 → ^3.0.0					dependencies	major
type-fest	^4.26.1 → ^5.0.0					devDependencies	major
yargs (source)	^17.7.2 → ^18.0.0					dependencies	major
yargs (source)	^17.7.2 → ^18.0.0					devDependencies	major
zod (source)	^3.23.8 → ^4.0.0					dependencies	major
zod (source)	^3.24.2 → ^4.0.0					dependencies	major

---

Release Notes

actions/toolkit (@​actions/core)

v3.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

v2.0.3

• Bump @actions/http-client to 3.0.2

v2.0.1

• Bump @​actions/exec from 1.1.1 to 2.0.0 #​2199

v2.0.0

• Add support for Node 24 #​2110
• Bump @​actions/http-client from 2.0.1 to 3.0.0

actions/toolkit (@​actions/exec)

v3.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

v2.0.0

• Add support for Node 24 #​2110
• Bump @​actions/io dependency from ^1.0.1 to ^2.0.0

actions/toolkit (@​actions/github)

v9.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()
  • Example: const { getOctokit, context } = await import('@​actions/github')
• Fix TypeScript compilation by migrating to ESM, enabling proper imports from @octokit/core/types

v8.0.1

• Update undici to 6.23.0
• Update @actions/http-client to 3.0.2

v8.0.0

• Update @​octokit dependencies
  • @octokit/core ^7.0.6
  • @octokit/plugin-paginate-rest ^14.0.0
  • @octokit/plugin-rest-endpoint-methods ^17.0.0
  • @octokit/request ^10.0.7
  • @octokit/request-error ^7.1.0
• Breaking change: Minimum Node.js version is now 20 (previously 18)

v7.0.0

• Update to v3.0.1 of @actions/http-client

bombshell-dev/clack (@​clack/prompts)

v1.1.0

Compare Source

Minor Changes

• e3333fb: Replaces picocolors with Node.js built-in styleText.

Patch Changes

• c3666e2: destruct limitOption param for better code readability, tweak types definitions
• ba3df8e: Fixes withGuide support in intro, outro, and cancel messages.
• Updated dependencies [e3333fb]
  • @​clack/core@​1.1.0

v1.0.1

Compare Source

Patch Changes

• 6404dc1: Disallows selection of disabled options in autocomplete.
• 86e36d8: Adds withGuide support to select prompt.
• c697439: Fixes line wrapping behavior in autocomplete.
• 0ded19c: Simplifies withGuide option checks.
• 0e4ddc9: Fixes withGuide support in password and path prompts.
• 76550d6: Adds withGuide support to selectKey prompt.
• f9b9953: Adds withGuide support to password prompt.
• 0e93ccb: Adds vertical arrangement option to confirm prompt.
• 4e9ae13: Adds withGuide support to confirm prompt.
• 0256238: Adds withGuide support to spinner prompt.
• Updated dependencies [6404dc1]
• Updated dependencies [2533180]
  • @​clack/core@​1.0.1

v1.0.0

Compare Source

Major Changes

• c713fd5: The package is now distributed as ESM-only. In v0 releases, the package was dual-published as CJS and ESM.

  For existing CJS projects using Node v20+, please see Node's guide on Loading ECMAScript modules using require().

Minor Changes

• 415410b: This adds a custom filter function to autocompleteMultiselect. It could be used, for example, to support fuzzy searching logic.

• 7bc3301: Prompts now have a userInput stored separately from their value.

• 8409f2c: feat: add styleFrame option for spinner

• 2837845: Adds suggestion and path prompts

• 99c3530: Adds format option to the note prompt to allow formatting of individual lines

• 0aaee4c: Added new taskLog prompt for log output which is cleared on success

• 729bbb6: Add support for customizable spinner cancel and error messages. Users can now customize these messages either per spinner instance or globally via the updateSettings function to support multilingual CLIs.

  This update also improves the architecture by exposing the core settings to the prompts package, enabling more consistent default message handling across the codebase.

  // Per-instance customization
  const spinner = prompts.spinner({
    cancelMessage: "Operación cancelada", // "Operation cancelled" in Spanish
    errorMessage: "Se produjo un error", // "An error occurred" in Spanish
  });
  
  // Global customization via updateSettings
  prompts.updateSettings({
    messages: {
      cancel: "Operación cancelada", // "Operation cancelled" in Spanish
      error: "Se produjo un error", // "An error occurred" in Spanish
    },
  });
  
  // Settings can now be accessed directly
  console.log(prompts.settings.messages.cancel); // "Operación cancelada"
  
  // Direct options take priority over global settings
  const spinner = prompts.spinner({
    cancelMessage: "Cancelled", // This will be used instead of the global setting
  });

• 44df9af: Adds a new groupSpacing option to grouped multi-select prompts. If set to an integer greater than 0, it will add that number of new lines between each group.

• 55645c2: Support wrapping autocomplete and select prompts.

• 9e5bc6c: Add support for signals in prompts, allowing them to be aborted.

• f2c2b89: Adds AutocompletePrompt to core with comprehensive tests and implement both autocomplete and autocomplete-multiselect components in prompts package.

• 38019c7: Updates the API for stopping spinners and progress bars to be clearer

  Previously, both the spinner and progress bar components used a single stop method that accepted a code to indicate success, cancellation, or error. This update separates these into distinct methods: stop(), cancel(), and error():

  const spinner = prompts.spinner();
  spinner.start();
  
  // Cancelling a spinner
  - spinner.stop(undefined, 1);
  + spinner.cancel();
  
  // Stopping with an error
  - spinner.stop(undefined, 2);
  + spinner.error();

  As before, you can pass a message to each method to customize the output displayed:

  spinner.cancel("Operation cancelled by user");
  progressBar.error("An error occurred during processing");

• c45b9fb: Adds support for detecting spinner cancellation via CTRL+C. This allows for graceful handling of user interruptions during long-running operations.

• f10071e: Using the group method, task logs can now have groups which themselves can have scrolling windows of logs.

• df4eea1: Remove suggestion prompt and change path prompt to be an autocomplete prompt.

• 76fd17f: Added new box prompt for rendering boxed text, similar a note.

• 9a09318: Adds new progress prompt to display a progess-bar

• 1604f97: Add clearOnError option to password prompt to automatically clear input when validation fails

• 9bd8072: Add a required option to autocomplete multiselect.

• 19558b9: Added support for custom frames in spinner prompt

Patch Changes

• 46dc0a4: Fixes multiselect only shows hints on the first item in the options list. Now correctly shows hints for all selected options with hint property.
• aea4573: Clamp scrolling windows to 5 rows.
• bfe0dd3: Prevents placeholder from being used as input value in text prompts
• 55eb280: Fix placeholder rendering when using autocomplete.
• 4d1d83b: Fixes rendering of multi-line messages and options in select prompt.
• 6176ced: Add withGuide support to note prompt
• 7b009df: Fix spinner clearing too many lines upwards when non-wrapping.
• 43aed55: Change styling of disabled multi-select options to have strikethrough.
• 17342d2: Exposes a new SpinnerResult type to describe the return type of spinner
• 282b39e: Wrap spinner output to allow for multi-line/wrapped messages.
• 2feaebb: Fix duplicated logs when scrolling through options with multiline messages by calculating rowPadding dynamically based on actual rendered lines instead of using a hardcoded value.
• 69681ea: Strip destructive ANSI codes from task log messages.
• b0fa7d8: Add support for wrapped messages in multi line prompts
• 9999adf: fix note component overflow bug
• 6868c1c: Adds a new selectableGroups boolean to the group multi-select prompt. Using selectableGroups: false will disable the ability to select a top-level group, but still allow every child to be selected individually.
• 7df841d: Removed all trailing space in prompt output and fixed various padding rendering bugs.
• 2839c66: fix(note): hard wrap text to column limit
• 7a556ad: Updates all prompts to accept a custom output and input stream
• 17d3650: Use a default import for picocolors to avoid run time errors in some environments.
• 7cc8a55: Messages passed to the stop method of a spinner no longer have dots stripped.
• b103ad3: Allow disabled options in multi-select and select prompts.
• 71b5029: Add missing nullish checks around values.
• 1a45f93: Switched from wrap-ansi to fast-wrap-ansi
• f952592: Fixes missing guide when rendering empty log lines.
• 372b526: Add clear method to spinner for stopping and clearing.
• d25f6d0: fix(note, box): handle CJK correctly
• 94fee2a: Changes placeholder to be a visual hint rather than a tabbable value.
• 7530af0: Fixes wrapping of cancelled and success messages of select prompt
• 4c89dd7: chore: use more accurate type to replace any in group select
• 0b852e1: Handle stop calls on spinners which have not yet been started.
• 42adff8: fix: add missing guide line in autocomplete-multiselect
• 8e2e30a: fix: fix autocomplete bar color when validate
• 2048eb1: Fix spinner's dots behavior with custom frames
• acc4c3a: Add a new withGuide option to all prompts to disable the default clack border
• 9b92161: Show symbol when withGuide is true for log messages
• 68dbf9b: select-key: Fixed wrapping and added new caseSensitive option
• 09e596c: refactor(progress): remove unnecessary return statement in start function
• 2310b43: Allow custom writables as output stream.
• ae84dd0: Update key binding text to show tab/space when navigating, and tab otherwise.
• Updated dependency on @clack/core to 1.0.0

conventional-changelog/commitlint (@​commitlint/cli)

v20.5.0

Compare Source

Bug Fixes

• cli: validate that --cwd directory exists before execution (#​4658) (cf80f75), closes #​4595

20.4.4 (2026-03-12)

Note: Version bump only for package @​commitlint/cli

20.4.3 (2026-03-03)

Bug Fixes

• footer parser does not escape special chars for regex #​4560 (#​4634) (8ff7c7f)

20.4.2 (2026-02-19)

Note: Version bump only for package @​commitlint/cli

20.4.1 (2026-02-02)

Note: Version bump only for package @​commitlint/cli

v20.4.4

Compare Source

Note: Version bump only for package @​commitlint/cli

v20.4.3

Compare Source

Bug Fixes

• footer parser does not escape special chars for regex #​4560 (#​4634) (8ff7c7f)

v20.4.2

Compare Source

Note: Version bump only for package @​commitlint/cli

v20.4.1

Compare Source

Note: Version bump only for package @​commitlint/cli

v20.4.0

Compare Source

Features

• upgrade conventional commit packages #​4082 (#​4597) (3aaf0a6)

20.3.1 (2026-01-08)

Note: Version bump only for package @​commitlint/cli

v20.3.1

Compare Source

Note: Version bump only for package @​commitlint/cli

v20.3.0

Compare Source

Note: Version bump only for package @​commitlint/cli

v20.2.0

Compare Source

Note: Version bump only for package @​commitlint/cli

v20.1.0

Compare Source

Note: Version bump only for package @​commitlint/cli

v20.0.0

Compare Source

Note: Version bump only for package @​commitlint/cli

19.8.1 (2025-05-08)

Bug Fixes

• update dependency tinyexec to v1 (#​4332) (e49449f)

conventional-changelog/commitlint (@̴

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) in timezone Europe/Stockholm, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

---

• Branch has one or more failed status checks

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 39a4cd9

Command	Status	Duration	Result
nx-cloud record -- nx format:check	❌ Failed	8s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-01-12 01:59:42 UTC

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 0131d0c.

Command	Status	Duration	Result
nx-cloud record -- nx format:check	❌ Failed	12s	View ↗

---

☁️ Nx Cloud last updated this comment at 2025-05-12 01:51:18 UTC

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 0131d0c.

Command	Status	Duration	Result
nx-cloud record -- nx format:check	❌ Failed	12s	View ↗

---

☁️ Nx Cloud last updated this comment at 2025-05-12 01:51:18 UTC

[sentry]

Bug: The upgrade to @actions/github v9.0.0 will likely break internal sub-path imports like import { Context } from '@actions/github/lib/context', causing runtime failures.
_{Severity: HIGH}

Suggested Fix

Remove direct imports from internal sub-paths of @actions/github. Access the Context object via the official github.context property. For WebhookPayload, find an equivalent type from the public API or define a local interface that matches the required structure.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: packages/nx-migrate-action/package.json#L24-L27

Potential issue: The upgrade to `@actions/github` v9.0.0 is expected to cause runtime
import errors. The code currently imports `Context` from `'@actions/github/lib/context'`
and `WebhookPayload` from `'@actions/github/lib/interfaces'`. These are internal,
non-guaranteed sub-paths. Major version upgrades, especially those involving a switch to
ESM, frequently refactor or remove such internal paths. This will break the
`getDeployEnv()` function, which is critical for determining deployment environments,
and also affect test setups.

_{Did we get this right? 👍 / 👎 to inform future reviews.}