chore(deps): bump commander from 12.1.0 to 14.0.3

[dependabot]

Bumps commander from 12.1.0 to 14.0.3.

Release notes

Sourced from commander's releases.

v14.0.3

Added

• Release Policy document (#2462)

Changes

• old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date (#2462)
• clarify typing for deprecated callback parameter to .outputHelp() (#2427)
• simple readability improvements to README (#2465)

v14.0.2

Changed

• improve negative number auto-detection test (#2428)
• update (dev) dependencies

v14.0.1

Fixed

• broken markdown link in README (#2369)

Changed

• improve code readability by using optional chaining (#2394)
• use more idiomatic code with object spread instead of Object.assign() (#2395)
• improve code readability using string.endsWith() instead of string.slice() (#2396)
• refactor .parseOptions() to process args array in-place (#2409)
• change private variadic support routines from ._concatValue() to ._collectValue() (change code from array.concat() to array.push()) (#2410)
• update (dev) dependencies

v14.0.0

Added

• support for groups of options and commands in the help using low-level .helpGroup() on Option and Command, and higher -level .optionsGroup() and .commandsGroup() which can be used in chaining way to specify group title for following option s/commands (#2328)
• support for unescaped negative numbers as option-arguments and command-arguments (#2339)
• TypeScript: add parseArg property to Argument class (#2359)

Fixed

• remove bogus leading space in help when option has default value but not a description (#2348)
• .configureOutput() now makes copy of settings instead of modifying in-place, fixing side-effects (#2350)

Changed

• Breaking: Commander 14 requires Node.js v20 or higher
• internal refactor of Help class adding .formatItemList() and .groupItems() methods (#2328)

... (truncated)

Changelog

Sourced from commander's changelog.

[14.0.3] (2026-01-31)

Added

• Release Policy document (#2462)

Changes

• old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date (#2462)
• clarify typing for deprecated callback parameter to .outputHelp() (#2427)
• simple readability improvements to README (#2465)

[14.0.2] (2025-10-25)

Changed

• improve negative number auto-detection test (#2428)
• update (dev) dependencies

[14.0.1] (2025-09-12)

Fixed

• broken markdown link in README (#2369)

Changed

• improve code readability by using optional chaining (#2394)
• use more idiomatic code with object spread instead of Object.assign() (#2395)
• improve code readability using string.endsWith() instead of string.slice() (#2396)
• refactor .parseOptions() to process args array in-place (#2409)
• change private variadic support routines from ._concatValue() to ._collectValue() (change code from array.concat() to array.push()) (#2410)
• update (dev) dependencies

[14.0.0] (2025-05-18)

Added

• support for groups of options and commands in the help using low-level .helpGroup() on Option and Command, and higher-level .optionsGroup() and .commandsGroup() which can be used in chaining way to specify group title for following options/commands (#2328)
• support for unescaped negative numbers as option-arguments and command-arguments (#2339)
• TypeScript: add parseArg property to Argument class (#2359)

Fixed

• remove bogus leading space in help when option has default value but not a description (#2348)
• .configureOutput() now makes copy of settings instead of modifying in-place, fixing side-effects (#2350)

Changed

• Breaking: Commander 14 requires Node.js v20 or higher

... (truncated)

Commits

• 8247364 14.0.3
• e281fe3 Update docs for 14.0.3 (#2474)
• 7357dda Separate out a more detailed release policy document (#2462)
• b6e2e3a Bump eslint from 9.39.1 to 9.39.2 (#2470)
• d6f63a7 Bump ts-jest from 29.4.5 to 29.4.6 (#2467)
• 2a9768a Bump prettier from 3.6.2 to 3.7.4 (#2466)
• 9211918 docs(README): Tweak formatting, punctuation for clarity (#2465)
• 4208a96 Bump typescript-eslint from 8.46.2 to 8.48.0 (#2458)
• 03308ce Bump eslint-plugin-jest from 29.0.1 to 29.2.1 (#2457)
• 4d2db1f Bump globals from 16.4.0 to 16.5.0 (#2456)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
commander	[>= 15.a, < 16]

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[zeshi-du]

Leaving this open rather than closing it, because unlike the action-pin bumps this one represents real outstanding work: the CI failures here are genuine, not infrastructural. The major carries breaking changes that need a migration pass through the test suite, and that has to happen on our internal source-of-truth repo first (this repository is a per-release mirror, so a bump landing only here blocks or gets reverted by the next snapshot).

I've queued the migration internally. When it lands, this PR will resolve itself on the next release snapshot.

Recording it here rather than silently closing so it doesn't look like the bump was dismissed.

[zeshi-du]

Closing this, but it's worth recording exactly how small the actual break is, because it's not a real compatibility problem.

Checked against 197fffb2: Build (Node 20/22), Typecheck, and Local E2E Tests all pass. What fails is all three unit-test jobs — Unit Tests (Node 20), Unit Tests (Node 22), and Unit Tests (Windows) — on the identical cause: test/help.snapshot.test.ts (Test Files 1 failed | 62 passed (63), the same 15 of 25 cases in that one file, in each job) — plus Coverage, which fails as a knock-on: it runs the same suite, hits the same failing file, and exits before coverage data is produced ("Coverage data was not generated. Check the test run for errors.").

The cause is exactly what it looks like from the diff — commander 14 wraps its auto-generated --help output at a different column width than commander 12 did, so the recorded snapshots mismatch on line-wrapping only, not content:

-                                than --debug; useful for diagnosing hangs
-                                without the full trace.
+                                than --debug; useful for diagnosing hangs without
+                                the full trace.

Fix is regenerating the snapshots (or pinning commander's help width via its output configuration) once we're on 14.x — that's a one-line-diff-per-snapshot job, not a rewrite. Dependency Review is also red here, for the usual unrelated reason (org dependency graph disabled).

This repo is a mirror — dependency bumps land in our source repo first and reach here via release snapshot — so it's closed here either way.

What would change the answer: once the snapshots are regenerated against commander 14 upstream, the equivalent bump ships in the next release snapshot; that's a same-day fix once someone's doing it, not a blocker on the dependency itself.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.