chore(deps): update dependency aqua:evilmartians/lefthook to v2.1.16

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
aqua:evilmartians/lefthook	tools	patch	2.1.9 → 2.1.16	2.2.1 (+2)

---

Release Notes

evilmartians/lefthook (aqua:evilmartians/lefthook)

v2.1.16

Compare Source

• fix: test staging fixed files with partially staged by @​mrexox
• fix: preserve unrelated unstaged changes on conflict (#​1483) by @​Sakshamm-Goyal
• deps: bump mod and text deps to resolve CVEs (#​1560) by @​devindavies
• ci: refactor publishing scripts (#​1559) by @​mrexox

v2.1.15

Compare Source

• fix: do not pipe stdin into post-checkout git-lfs hook (#​1523) by @​rwinkelman
• fix: remove color blending (#​1558) by @​mrexox
• fix: resolve push-files fallback against the remote-tracking ref (#​1485) by @​hamodywe
• test: regression for valid fish shell completion output (#​1527) by @​rwinkelman
• fix: sanitize slashes in remote ref when building the checkout dir name (#​1486) by @​hamodywe
• fix: quote paths in the generated hook shim (#​1509) by @​addielaruee
• feat: propagate forced colors to hook commands via CLICOLOR_FORCE (#​1547) by @​Yash121l

v2.1.14

Compare Source

• fix: error when --job/--command matches nothing (#​1512) by @​nityanand123gupta
• fix: disable tty things when stdout is not TTY (#​1545) by @​mrexox
• docs: document files inheritance for grouped jobs (#​1536) by @​chiliec
• fix: force colors when colors are explicitly enabled (#​1538) by @​Yash121l
• fix: resolve file_types paths from the repo root (#​1537) by @​Yash121l
• fix: don't force-install hooks from the npm postinstall (#​1510) by @​hamodywe
• docs: quote template run examples (#​1472) by @​Guflly

v2.1.13

Compare Source

• fix: error when --job/--command matches nothing (#​1512) by @​nityanand123gupta
• fix: disable tty things when stdout is not TTY (#​1545) by @​mrexox
• docs: document files inheritance for grouped jobs (#​1536) by @​chiliec
• fix: force colors when colors are explicitly enabled (#​1538) by @​Yash121l
• fix: resolve file_types paths from the repo root (#​1537) by @​Yash121l
• fix: don't force-install hooks from the npm postinstall (#​1510) by @​hamodywe
• docs: quote template run examples (#​1472) by @​Guflly

v2.1.12

Compare Source

• fix: fail the hook when staging fixed files errors (#​1484) by @​teddytennant
• fix: LEFTHOOK_OUTPUT precedence (#​1506) by @​Yuki9814
• ci: fix npm publishing by bumping Node to 24 (#​1508) by @​mariokresic

v2.1.11

Compare Source

• fix: inherit terminal size for PTY commands (#​1498) by @​mariokresic
• docs: correct Lefthook commit message configuration (#​1499) by @​codersjj
• docs: hide contributors regenerate tip from the site (#​1500) by @​MikevPeeren
• docs: clarify signed-off commit example (#​1492) by @​nightcityblade
• deps: bump Go to 1.26.6 (#​1495) by @​quaacxlok
• docs: fix em notice by @​mrexox
• docs: update docmd (#​1481) by @​mrexox
• docs: fix EM mention HTML by @​mrexox
• docs: clarify remote script folders (#​1477) by @​scop
• docs: document script args (#​1479) by @​lntutor
• docs: update em logo by @​mrexox

v2.1.10

Compare Source

• deps: July 2026 (#​1463) by @​mrexox
• feat: AI coding agents integration (#​1448) by @​viralpraxis
• docs: fix language (#​1453) by @​pflanze
• fix: make test suite stable when NO_COLOR is set (#​1449) by @​viralpraxis
• deps: June 2026 (#​1447) by @​mrexox
• deps: migrate shellescape to al.essio.dev/pkg/shellescape (#​1443) by @​maguowei
• docs: upgrade docmd (#​1442) by @​mrexox
• docs: use single quotes in example to handle filepaths with $ by @​mrexox

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

This PR updates lefthook from v2.1.9 to v2.1.16, spanning 7 patch releases (v2.1.10 through v2.1.16). All changes are backward-compatible bug fixes and minor enhancements with no breaking changes.

Key Changes Across Versions:

v2.1.16:

• Fix: Test staging fixed files with partially staged content
• Fix: Preserve unrelated unstaged changes on conflict
• Security: Bump mod and text deps to resolve CVEs (#1560)
• CI: Refactor publishing scripts

v2.1.15:

• Fix: Do not pipe stdin into post-checkout git-lfs hook
• Fix: Remove color blending
• Fix: Resolve push-files fallback against remote-tracking ref
• Fix: Sanitize slashes in remote ref when building checkout dir name
• Fix: Quote paths in generated hook shim
• Feature: Propagate forced colors to hook commands via CLICOLOR_FORCE

v2.1.14:

• Fix: Error when --job/--command matches nothing
• Fix: Disable tty things when stdout is not TTY
• Fix: Force colors when colors are explicitly enabled
• Fix: Resolve file_types paths from the repo root
• Fix: Don't force-install hooks from npm postinstall

v2.1.13:

• Duplicate of v2.1.14 changes (re-release)

v2.1.12:

• Fix: Fail the hook when staging fixed files errors
• Fix: LEFTHOOK_OUTPUT precedence
• CI: Fix npm publishing by bumping Node to 24

v2.1.11:

• Fix: Inherit terminal size for PTY commands
• Deps: Bump Go to 1.26.6
• Documentation improvements

v2.1.10:

• Feature: AI coding agents integration
• Fix: Make test suite stable when NO_COLOR is set
• Deps: Migration to al.essio.dev/pkg/shellescape

Security Fixes:

• v2.1.16 includes dependency updates to resolve CVEs (#1560)

Breaking Changes:

• None

🎯 Impact Scope Investigation

Current Usage in Codebase:

1. mise.toml (mise.toml:4) - Tool version declaration only
2. lefthook.yml - Git hook configuration with the following hooks:
   • pre-commit: go fmt, golangci-lint run, gitleaks git --pre-commit --staged, hadolint
   • pre-push: gitleaks git
3. CLAUDE.md - Documentation reference (line 15)

Configuration Analysis:

The project uses standard lefthook features:

• stage_fixed: true for go fmt (v2.1.16 improves this with partial staging fix)
• glob patterns for file filtering
• run commands for hook execution

All configuration options used are stable and fully supported across v2.1.9 to v2.1.16.

Dependency Impact:

• No impact on other dependencies
• Lefthook is a development tool managed via mise
• Does not affect runtime behavior or Docker image
• Only impacts local development and CI git hooks

CI/CD Impact:

• CI workflow (.github/workflows/ci.yml) uses mise-action which automatically installs tools from mise.toml
• No changes needed to CI configuration
• Git hooks are not executed in CI (CI runs linters/tests directly)

Version Compatibility:

• All features used in lefthook.yml are present and stable since before v2.1.9
• Configuration syntax remains unchanged
• No migration required

💡 Recommended Actions

Immediate Actions:

1. ✅ Safe to merge - No code changes or configuration updates required
2. After merge, developers should run mise install to update their local lefthook installation

Post-Merge Validation:

1. Verify pre-commit hooks execute successfully: git commit (test locally)
2. Verify pre-push hooks execute successfully: git push (test locally)
3. Expected behavior remains the same as v2.1.9

Benefits of This Update:

• Security improvements from CVE fixes in dependencies
• Better handling of partially staged files with stage_fixed: true (directly benefits this project's go fmt hook)
• Improved path quoting in generated hook shims
• Better color handling and TTY detection

No Migration Required:

• Configuration file (lefthook.yml) requires no changes
• All existing hooks will continue to work exactly as before
• The update is purely additive (bug fixes + minor enhancements)

🔗 Reference Links

• Release v2.1.16
• Release v2.1.15
• Release v2.1.14
• Release v2.1.12
• Release v2.1.11
• Release v2.1.10
• CHANGELOG
• CVE Fix PR #1560

Generated by koki-develop/claude-renovate-review