Skip to content

chore(deps): bump commander from 11.1.0 to 14.0.3 in /packages/cli - #236

Merged
M0nsxx merged 2 commits into
mainfrom
dependabot/npm_and_yarn/packages/cli/commander-14.0.3
Nov 4, 2026
Merged

chore(deps): bump commander from 11.1.0 to 14.0.3 in /packages/cli#236
M0nsxx merged 2 commits into
mainfrom
dependabot/npm_and_yarn/packages/cli/commander-14.0.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps commander from 11.1.0 to 14.0.3.

Release notes

Sourced from commander's releases.

v14.0.3

Added

  • Release Policy document (#2462)

Changes

  • old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date (#2462)
  • clarify typing for deprecated callback parameter to .outputHelp() (#2427)
  • simple readability improvements to README (#2465)

v14.0.2

Changed

  • improve negative number auto-detection test (#2428)
  • update (dev) dependencies

v14.0.1

Fixed

  • broken markdown link in README (#2369)

Changed

  • improve code readability by using optional chaining (#2394)
  • use more idiomatic code with object spread instead of Object.assign() (#2395)
  • improve code readability using string.endsWith() instead of string.slice() (#2396)
  • refactor .parseOptions() to process args array in-place (#2409)
  • change private variadic support routines from ._concatValue() to ._collectValue() (change code from array.concat() to array.push()) (#2410)
  • update (dev) dependencies

v14.0.0

Added

  • support for groups of options and commands in the help using low-level .helpGroup() on Option and Command, and higher -level .optionsGroup() and .commandsGroup() which can be used in chaining way to specify group title for following option s/commands (#2328)
  • support for unescaped negative numbers as option-arguments and command-arguments (#2339)
  • TypeScript: add parseArg property to Argument class (#2359)

Fixed

  • remove bogus leading space in help when option has default value but not a description (#2348)
  • .configureOutput() now makes copy of settings instead of modifying in-place, fixing side-effects (#2350)

Changed

  • Breaking: Commander 14 requires Node.js v20 or higher
  • internal refactor of Help class adding .formatItemList() and .groupItems() methods (#2328)

... (truncated)

Changelog

Sourced from commander's changelog.

[14.0.3] (2026-01-31)

Added

  • Release Policy document (#2462)

Changes

  • old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date (#2462)
  • clarify typing for deprecated callback parameter to .outputHelp() (#2427)
  • simple readability improvements to README (#2465)

[14.0.2] (2025-10-25)

Changed

  • improve negative number auto-detection test (#2428)
  • update (dev) dependencies

[14.0.1] (2025-09-12)

Fixed

  • broken markdown link in README (#2369)

Changed

  • improve code readability by using optional chaining (#2394)
  • use more idiomatic code with object spread instead of Object.assign() (#2395)
  • improve code readability using string.endsWith() instead of string.slice() (#2396)
  • refactor .parseOptions() to process args array in-place (#2409)
  • change private variadic support routines from ._concatValue() to ._collectValue() (change code from array.concat() to array.push()) (#2410)
  • update (dev) dependencies

[14.0.0] (2025-05-18)

Added

  • support for groups of options and commands in the help using low-level .helpGroup() on Option and Command, and higher-level .optionsGroup() and .commandsGroup() which can be used in chaining way to specify group title for following options/commands (#2328)
  • support for unescaped negative numbers as option-arguments and command-arguments (#2339)
  • TypeScript: add parseArg property to Argument class (#2359)

Fixed

  • remove bogus leading space in help when option has default value but not a description (#2348)
  • .configureOutput() now makes copy of settings instead of modifying in-place, fixing side-effects (#2350)

Changed

  • Breaking: Commander 14 requires Node.js v20 or higher

... (truncated)

Commits

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
commander [>= 15.a, < 16]

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 2, 2026
@dependabot
dependabot Bot requested a review from M0nsxx as a code owner November 2, 2026 12:19
@dependabot
chore(deps): bump commander from 11.1.0 to 14.0.3 in /packages/cli
91334f5 
Bumps [commander](https://github.com/tj/commander.js) from 11.1.0 to 14.0.3.
- [Release notes](https://github.com/tj/commander.js/releases)
- [Changelog](https://github.com/tj/commander.js/blob/master/CHANGELOG.md)
- [Commits](tj/commander.js@v11.1.0...v14.0.3)

---
updated-dependencies:
- dependency-name: commander
  dependency-version: 14.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/cli/commander-14.0.3 branch from 1842164 to 91334f5 Compare November 4, 2026 01:55
@Eras256 @claude @M0nsxx
fix(cli): drop the invalid '-port' short flag, commander 14 rejects it
d4ef0f7 
commander 11 silently tolerated '-port' as a short-flag alias (multiple
characters after a single dash); commander 14 validates this strictly and
throws "option creation failed due to '-port'" at CLI startup, breaking
every command - confirmed live: reproduces identically with 14.0.3, gone
after this fix, and does NOT reproduce by reverting to 11.1.0 alone
(the flag was always invalid, 11 just never checked).

Dropped the short alias entirely rather than picking a new letter - every
single-letter option already used by this command (-p price, -P pay-to,
-n network, -r route, -c config) rules out an obvious free choice, and
--port alone is unambiguous.

Verified locally against the PR's actual commander@14.0.3: the 2 original
test failures in config-secret.test.js (both about this exact crash,
ERR_ASSERTION/exit code 1) are gone. 3 other failures in the same file
remain, but reproduce identically on unpatched main with commander@11.1.0
too - pre-existing, unrelated to this bump or this fix (looks like a
local TTY/stdin environment difference, not a real regression).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
M0nsxx
M0nsxx approved these changes Nov 4, 2026
View reviewed changes

@M0nsxx M0nsxx left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed: the real break was -port as a short-flag alias in packages/cli/bin/nirium.js:232 — commander 11 tolerated it, commander 14 validates strictly and throws. Fixed by dropping the invalid short flag (kept only --port), verified locally against commander@14.0.3 that the CLI loads and the crash is gone. CI green across the board. Approving.

@M0nsxx
M0nsxx merged commit 107ec89 into main Nov 4, 2026
4 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/packages/cli/commander-14.0.3 branch November 4, 2026 02:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@M0nsxx M0nsxx M0nsxx approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@M0nsxx @Eras256