chore(deps): lock file maintenance npm dependencies

[red-hat-konflux]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 04:59 AM (* 0-4 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[tsd-agent-bot]

🤖 Automated review by tsd-agent-bot (tsd-agent-lab pr-review skill). Findings are advisory — please verify before acting on them.

Full review (43 lines)

PR #330 Review: chore(deps): lock file maintenance npm dependencies

Summary of Change

This is an automated, bot-generated (red-hat-konflux) lock file maintenance PR. It touches only package-lock.json — no changes to package.json. All modifications are transitive dependency version bumps resolved within their existing semver ranges (e.g., @commitlint/cli 21.1.0 → 21.2.0, conventional-changelog-angular 8.3.1 → 9.2.0, conventional-changelog-conventionalcommits 9.3.1 → 10.2.0, conventional-commits-parser 6.4.0 → 7.0.0, meow 13.2.0 → 14.1.0, vite 8.1.0 → 8.1.2, plus a caniuse-lite data patch and httpxy patch bump). Some transitive sub-dependencies (compare-func, array-ify, dot-prop, is-obj) were dropped, apparently absorbed internally by @conventional-changelog/template.

Findings

Critical

None identified.

High

None identified.

Medium

None identified.

• Note (not a defect, informational): Several transitive packages show major-version jumps in their own versioning (conventional-changelog-conventionalcommits 9→10, conventional-commits-parser 6→7, meow 13→14, conventional-changelog-angular 8→9). This is expected and benign for a lockfile-maintenance PR if and only if these are resolved as transitive dependencies of @commitlint/* packages whose own package.json ranges permit the bump (e.g., a caret/tilde range on @commitlint/cli allowing a minor bump that itself now depends on newer majors of its internals). Since package.json is unchanged, npm's resolver only moved within already-declared ranges, so this is consistent with normal lockfile churn rather than a scope violation. Flagged as informational because major-version bumps of tooling like conventional-commits-parser can occasionally change commit-message parsing behavior (relevant to commitlint/semantic-release pipelines), so if this repo relies on commit-message linting/parsing in CI, it's worth a quick sanity check that commit hooks still pass post-merge — but this is a low-probability, low-impact concern given these are dev-only tooling packages.

Low

1. Location: package-lock.json (general)
   Issue: As a fully bot-generated, lockfile-only diff, there is no meaningful "diff readability" for a human reviewer — the change is definitionally opaque without running npm ls/npm audit locally.
   Recommendation: Rely on CI (install + build + test + lint) passing rather than manual diff inspection; this is the correct review posture for this PR type.
   Confidence: high

Verification Against Special Guidance

• (a) Major version boundary crossings: The version bumps observed are all within the resolver's existing semver-range latitude for direct devDependencies (no package.json range changes). Sub-dependency major bumps (e.g., conventional-commits-parser 6→7) are internal to the @commitlint/conventional-changelog dependency trees and not surprising for a "lock file maintenance" run, which by design re-resolves to the latest versions satisfying existing ranges. Nothing here indicates an unintended or out-of-range major upgrade.
• (b) devDependencies vs runtime dependencies: All packages named in the diff (@commitlint/*, conventional-changelog-angular, conventional-changelog-conventionalcommits, conventional-commits-parser, meow, caniuse-lite, httpxy, vite) are build/lint/commit-tooling or dev-server dependencies. No runtime/production dependency changes are evident in the provided diff. This substantially lowers risk — a regression here would surface as a broken commit-lint hook or dev build, not a production runtime failure.
• (c) Internal consistency: No orphaned or duplicate entries are apparent from the excerpt; the removal of compare-func/array-ify/dot-prop/is-obj is explained as those packages being absorbed/replaced internally by @conventional-changelog/template in the newer conventional-changelog-angular release, which is a normal and expected lockfile cleanup pattern (not a sign of a broken tree). A full consistency check (npm ci succeeding, no npm warnings about missing peers) would need to be confirmed by CI, but nothing in the diff pattern suggests inconsistency.
• (d) Overall risk of merging: Low. This is a routine, automated devDependency lockfile refresh with no production dependency or package.json changes.

Overall Assessment

Ready to merge: Yes, pending CI (install, build, lint, test) passing green.

Blocking issues: None.

Key risks:

• Low overall risk given the change is confined to devDependencies (build/commit-lint/test tooling), with no runtime dependency or declared version-range changes.
• The only residual risk is behavioral drift in commit-message parsing/linting tooling (conventional-commits-parser, conventional-changelog-angular major bumps) if this repo's CI enforces conventional-commit format — worth a glance at CI results for the commitlint step specifically, but not a reason to hold the PR absent an actual CI failure.
• Standard practice for bot-authored lockfile-maintenance PRs: merge on green CI without manual line-by-line lockfile scrutiny, which this review has intentionally avoided per the provided guidance.