chore(deps-dev): bump @commitlint/cli from 17.7.1 to 20.5.0

[dependabot]

Bumps @commitlint/cli from 17.7.1 to 20.5.0.

Release notes

Sourced from @​commitlint/cli's releases.

v20.5.0

20.5.0 (2026-03-15)

Bug Fixes

• fix(resolve-extends): always resolve extended parser presets for proper merging by @​omar-y-abdi in conventional-changelog/commitlint#4647
• fix(load): resolve async config exports in CJS projects by @​omar-y-abdi in conventional-changelog/commitlint#4659
• fix(cli): validate that --cwd directory exists before execution by @​omar-y-abdi in conventional-changelog/commitlint#4658

Features

• feat(cz-commitlint): add exclamation mark support for breaking changes by @​mrt181 in conventional-changelog/commitlint#4655

New Contributors

• @​mrt181 made their first contribution in conventional-changelog/commitlint#4655
• @​omar-y-abdi made their first contribution in conventional-changelog/commitlint#4647

Full Changelog: conventional-changelog/commitlint@v20.4.4...v20.5.0

v20.4.4

20.4.4 (2026-03-12)

Bug Fixes

• fix(types): allow context parameter in QualifiedRuleConfig functions by @​Br1an67 in conventional-changelog/commitlint#4636
• fix(read): update git-raw-commits to v5 API by @​Tamas-hi in conventional-changelog/commitlint#4638
• fix(is-ignored): strip CI skip markers from release commits by @​Br1an67 in conventional-changelog/commitlint#4637

New Contributors

• @​Br1an67 made their first contribution in conventional-changelog/commitlint#4636
• @​Tamas-hi made their first contribution in conventional-changelog/commitlint#4638

Full Changelog: conventional-changelog/commitlint@v20.4.3...v20.4.4

v20.4.3

20.4.3 (2026-03-03)

Bug Fixes

• fix: npx usage #613 by @​escapedcat in conventional-changelog/commitlint#4630
• fix(types): incorrect types for rule options by @​Zamiell in conventional-changelog/commitlint#4633

... (truncated)

Changelog

Sourced from @​commitlint/cli's changelog.

20.5.0 (2026-03-15)

Bug Fixes

• cli: validate that --cwd directory exists before execution (#4658) (cf80f75), closes #4595

20.4.4 (2026-03-12)

Note: Version bump only for package @​commitlint/cli

20.4.3 (2026-03-03)

Bug Fixes

• footer parser does not escape special chars for regex #4560 (#4634) (8ff7c7f)

20.4.2 (2026-02-19)

Note: Version bump only for package @​commitlint/cli

20.4.1 (2026-02-02)

Note: Version bump only for package @​commitlint/cli

20.4.0 (2026-01-30)

Features

... (truncated)

Commits

• a7918e9 v20.5.0
• cf80f75 fix(cli): validate that --cwd directory exists before execution (#4658)
• 02d7245 v20.4.4
• a746981 v20.4.3
• 18bd371 chore: deps (#4635)
• 8ff7c7f fix: footer parser does not escape special chars for regex #4560 (#4634)
• 81cfc9e v20.4.2
• e7ae28d v20.4.1
• c68de5e v20.4.0
• 3aaf0a6 feat: upgrade conventional commit packages #4082 (#4597)
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​commitlint/​cli@​17.7.1 ⏵ 20.5.0	+1		-1
	etag@​1.8.1
	damerau-levenshtein@​1.0.8
	throttle-debounce@​5.0.2
	date-fns@​3.6.0
	object-hash@​3.0.0
	postcss@​8.5.8
	uuid@​10.0.0
	cors@​2.8.5
	ua-parser-js@​0.7.33
	zod@​3.23.8
	typescript@​6.0.2
	dotenv@​16.4.5
	playwright@​1.58.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Critical CVE: npm form-data uses unsafe random function in form-data for choosing boundary CVE: GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL) Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4 Patched version: 2.5.4 From: pnpm-lock.yaml → npm/form-data@2.5.1 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/form-data@2.5.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: Handlebars.js has JavaScript Injection via AST Type Confusion CVE: GHSA-2w6w-674q-4c4q Handlebars.js has JavaScript Injection via AST Type Confusion (CRITICAL) Affected versions: >= 4.0.0 < 4.7.9 Patched version: 4.7.9 From: pnpm-lock.yaml → npm/handlebars@4.7.8 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/handlebars@4.7.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm entities is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: pnpm-lock.yaml → npm/entities@4.5.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@4.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report