chore(deps): update dependency lefthook to v2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
lefthook	1.11.14 → 2.1.9

---

Release Notes

evilmartians/lefthook (lefthook)

v2.1.9

Compare Source

• fix: update hooks path after resetting (#​1431) by @​mrexox
• deps: May 2026 (#​1415) by @​mrexox

v2.1.8

Compare Source

• fix: do not warn if local hooks path is equal to default hooks path (#​1421) by @​mrexox

v2.1.7

Compare Source

• fix: use contrast colors (#​1420) by @​mrexox
• fix: apply stage_fixed only if it is safe (#​1418) by @​mrexox
• fix: try to always restore unstaged changes (#​1417) by @​mrexox
• fix: always restore unstaged changes (#​1416) by @​mrexox
• refactor: add new logger without a global state (#​1385) by @​mrexox
• fix: linter, sacrifice optimization for readability by @​mrexox
• fix: separate fallback push branch from pathspecs (#​1396) by @​lawrence3699

v2.1.6

Compare Source

• fix: normalize lefthook path for sh script (#​1383) by @​AndrewKahr
• fix: normalize root to always include trailing slash before path replacement (#​1381) by @​Copilot
• fix: skip pty allocation when stdout is not a terminal (#​1393) by @​technicalpickles
• docs: upgrade docmd (#​1391) by @​mrexox
• fix: log full scoped name for skipped jobs (#​1291) by @​scop
• fix: do not pipe stdout and stderr (#​1382) by @​mrexox

v2.1.5

Compare Source

• deps: April 2026 (#​1375) by @​mrexox
• docs: update documentation and docs for claude (#​1373) by @​mrexox
• fix: git repository merge issue (#​1372) by @​mrexox
• fix: use pre-push stdin for push file detection (#​1368) by @​supitsdu
• chore: small cleanup (#​1370) by @​mrexox
• fix: prevent lefthook run from overwriting global hooks (#​1371) by @​ivy
• chore: upgrade to 2.11.4 (#​1362) by @​scop
• chore: fix golangci-lint version lookup by @​mrexox
• chore: move golangci-lint version to .tool-versions (#​1349) by @​scop

v2.1.4

Compare Source

• pkg: fix scripts (#​1348) by @​mrexox
• fix: bring back {lefthook_job_name} template (#​1347) by @​mrexox
• pkg: refactor packaging (2) (#​1346) by @​mrexox
• fix: separate more commands' non-option args with -- (#​1339) by @​scop
• docs: change logo to point to landing page instead of itself (#​1343) by @​igas
• pkg: make it easier to read (#​1340) by @​mrexox
• pkg: refactor packaging scripts (#​1308) by @​mrexox

v2.1.3

Compare Source

• chore: switch artifact attestations gen to actions/attest v4 (#​1338) by @​scop
• chore: describe ENV variables usage in CLI help output (#​1337) by @​mrexox
• fix: support git debug versions (#​1334) by @​mrexox
• deps: March 2026 (#​1330) by @​mrexox
• feat: update minimum go version (#​1331) by @​mrexox

v2.1.2

Compare Source

• feat: introduce setup hook option (#​1326) by @​mrexox
• refactor: recovering logic for changesets (#​1324) by @​mrexox
• fix: rollback auto-staged changes if unwanted changes detected (#​1251) by @​tuchfarber
• docs: improve docs ui (#​1323) by @​mrexox
• docs: additional skip example and note about reinstallation (#​1319) by @​iloveitaly
• docs: fix incorrect --verbose usage (#​1318) by @​iloveitaly
• pkg: fix python packages publishing by @​mrexox

v2.1.1

Compare Source

• ci: fix publishing to PyPi by @​mrexox
• fix: reset colors on config read (#​1309) by @​mrexox
• chore: reduce verbosity of hints in lefthook install (#​1303) by @​joevin-slq-docto
• docs: add missing /v2 suffix for go get -tool (#​1304) by @​alexandregv

v2.1.0

Compare Source

• ci: skip Python publishing by [@​mrexox][]
• chore: fancy wording and indentation for hits by [@​mrexox][]
• feat: check core.hooksPath when lefthook install (#​1292) by [@​joevin-slq-docto][]
• feat: allow installing non-git hooks (#​1301) by [@​mrexox][]

v2.0.16

Compare Source

• chore: timeout cleanup (#​1297) by @​mrexox
• feat: add timeout argument (#​1263) by @​franzramadhan
• deps: January 2026 (#​1285) by @​mrexox
• pkg: pack one binary per platform into python wheels (#​1181) by @​danfimov
• fix: accept string in file_types (#​1288) by @​scop
• docs: elaborate on when to refetch and failure mode (#​1287) by @​scop
• fix: try reading direct file instead of all remotes (#​1243) by @​mrexox
• perf: [breaking] skip ghost hook when hooks are already configured (#​1255) by @​WooWan
• chore: upgrade to 2.8.0 (#​1278) by @​scop

v2.0.15

Compare Source

• docs: clarify remote settings (#​1260) by @​mrexox
• feat: skip scripts if args given with empty file template (#​1277) by @​mrexox

v2.0.14

Compare Source

• fix: skip if any files template is empty (#​1275) by @​mrexox
• feat: add jsonc support (#​1274) by @​mrexox
• deps: switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 (#​1261) by @​scop
• fix: don't install custom hooks to hooks dir (#​1246) by @​scop
• deps: December 2025 (#​1209) by @​mrexox

v2.0.13

Compare Source

• fix: set extends to empty slice after loading remotes (#​1259) by @​mrexox
• fix: allow custom hooks in JSON schema by updating generator (#​1250) by @​jeonghoon11
• docs: remove duplicate config: false description (#​1245) by @​scop
• chore: add more tests (#​1244) by @​mrexox

v2.0.12

Compare Source

• chore: small changes on diff printing (#​1242) by @​mrexox
• feat: ability to show diff when failing on changes (#​1227) by @​scop
• fix: make short status parser more robust (#​1236) by @​scop
• docs: fix readme (#​1235) by @​matdibu

v2.0.11

Compare Source

• feat: refetch and cleanup on ref change (#​1210) by @​mrexox
• ci: npm trusted publishing (#​1234) by @​mrexox
• feat: more rudimentary shell completions (#​1230) by @​scop

v2.0.10

Compare Source

• feat: add no_auto_install to lefthook.yml (#​1231) by @​pavelzw
• fix: skip if empty files template (#​1233) by @​mrexox

v2.0.9

Compare Source

• fix: skip pre commit hook if no staged files (#​1229) by @​mrexox
• fix: do not try to hash-object directories (#​1220) by @​scop
• fix: check and report Scanner errors (#​1222) by @​scop
• refactor: command executor tweaks (#​1224) by @​scop
• refactor: remove some redundant code (#​1221) by @​scop
• fix: improve separation of options and filenames for more git commands (#​1225) by @​scop
• chore: upgrade golangci-lint to 2.7.1, add godoclint (#​1223) by @​scop
• chore: remove unnecessary .svg executable permissions (#​1219) by @​scop

v2.0.8

Compare Source

• fix: do not escape custom templates in command replacement (#​1213) by @​joevin-sql-docto

v2.0.7

Compare Source

• fix: prefer using lefthook from the $PATH (#​1211) by @​joevin-sql-docto

v2.0.6

Compare Source

• feat: save original executable location in hooks (#​1208) by @​mrexox
• docs: encourage python install using pipx (#​1207) by @​franzramadhan

v2.0.5

Compare Source

• feat: add optional args to scripts (#​1206) by @​mrexox
• deps: November 2025 (#​1200) by @​mrexox
• chore: upgrade golangci-lint to 2.6.1, add modernize (#​1190) by @​scop
• chore: publish artifact attestations (#​1189) by @​scop

v2.0.4

Compare Source

• fix: glob_matcher jsonschema values
• feat: add optional standard glob matcher (doublestar) (#​1188) by @​jasonwbarnett

v2.0.3

Compare Source

• feat: fail_on_changes non-ci option (#​1186) by @​scop
• deps: update mimetypes (#​1185) by @​mrexox

v2.0.2

Compare Source

• fix: add mutex lock before all git commands (#​1178) by @​mrexox

v2.0.1

Compare Source

• chore: timeout cleanup (#​1297) by @​mrexox
• feat: add timeout argument (#​1263) by @​franzramadhan
• deps: January 2026 (#​1285) by @​mrexox
• pkg: pack one binary per platform into python wheels (#​1181) by @​danfimov
• fix: accept string in file_types (#​1288) by @​scop
• docs: elaborate on when to refetch and failure mode (#​1287) by @​scop
• fix: try reading direct file instead of all remotes (#​1243) by @​mrexox
• perf: [breaking] skip ghost hook when hooks are already configured (#​1255) by @​WooWan
• chore: upgrade to 2.8.0 (#​1278) by @​scop

v2.0.0

Compare Source

Breaking changes

• exclude option no longer accepts regexp, only globs.
• skip_output option is dropped, use output instead.
• Some CLI arguments have changed their names to make it more consistent. See lefthook run -h for details.
• for only and skip options with - run: '...' values the command executer was changed to Bourne Shell.

Commits

• fix: accept --fail-on-changes=false as override value (#​1168) by @​mrexox
• feat: [breaking] use sh as command executor on Windows (#​1166) by @​mrexox
• refactor: [breaking] drop support for exclude regexp (#​1162) by @​mrexox
• refactor: [breaking] drop deprecated skip_output option (#​1159) by @​mrexox
• refactor: [breaking] use another cli framework (#​1155) by @​mrexox

v1.13.6

Compare Source

• fix: embed jsonschema into binary (#​1158) by @​mrexox

v1.13.5

Compare Source

• chore: a small cleanup by @​mrexox
• refactor: use semver to check versions (#​1152) by @​mrexox
• fix: add comprehensive tests for spinner name formatting (#​1145) @​technicalpickles
• docs: add LEFTHOOK_BIN environment variable to documentation (#​1151) @​technicalpickles
• chore: tests improvements (#​1148) by @​mrexox
• chore: fix naming for integration tests (#​1146) by @​mrexox
• docs: use codecov coverage badge by @​mrexox
• ci: codecov (#​1147) by @​mrexox
• docs: use actual latest version (#​1143) by @​mrexox
• docs: add exclude to hook-level settings by @​mrexox

v1.13.4

Compare Source

• fix: add exclude option to hook level (#​1141) by @​mrexox
• fix: allow skipping groups (#​1140) by @​mrexox

v1.13.3

Compare Source

• deps: September 2025 (#​1139) by @​mrexox
• fix: concurrent map access issue (#​1138) by @​mrexox

v1.13.2

Compare Source

• feat: inherit file_types from parent jobs (#​1135) by @​mrexox
• fix: move gen at root (#​1133) by @​mrexox
• refactor: better scope subpackages (#​1132) by @​mrexox

v1.13.1

Compare Source

• feat: add no stage fixed argument (#​1130) by @​mrexox
• refactor: reduce the amount of code in a single file (#​1131) by @​mrexox
• fix: re-evaluate status for changeset (#​1129) by @​mrexox
• refactor: reduce the amount of code in a single file (#​1118) by @​mrexox
• chore: update issue templates by @​mrexox
• docs: add fail_on_changes to configuration/README.md (#​1119) by @​7crabs
• docs: update go installation note (#​1117) by @​leakedmemory

v1.13.0

Compare Source

• fix: use batched cmd for calculating git hashes (#​1116) by @​mrexox
• fix: add mutex to prevent concurrent git adds (#​1115) by @​mrexox
• refactor: improve structuring (#​1103) by @​mrexox
• feat: fail on change (#​1095) by @​olivier-lacroix
• fix: set --force for git add command (#​1104) by @​michaelm
• feat: recursively log successful results in summary (#​1108) by @​siler
• fix: groups with successes and skips are successful (#​1107) by @​siler

v1.12.4

Compare Source

• deps: September 2025 (#​1102) by @​mrexox
• feat: add tags argument (#​1101) by @​mrexox
• chore: bump github.com/go-viper/mapstructure/v2 (#​1094)

v1.12.3

Compare Source

• feat: add MIME types to file_types filters (#​1092)
• fix: respect LEFTHOOK_CONFIG in lefthook install (#​1090) by @​TECHNOFAB11
• docs: update pnpm installation note (#​1089) by @​skoch13
• docs: improve wording of run, files, and files-global config descriptions, document that the sh shell is used (#​1086) by @​ItsHarper
• docs: 404 for local-config (#​1082) by @​rammanoj
• docs: fix typo (#​1079) by @​eai04191

v1.12.2

Compare Source

• feat: add implicit template lefthook_job_name (#​1074)
• docs: restructure documentation (#​1075) by @​mrexox
• feat: allow overriding config path using LEFTHOOK_CONFIG env (#​1072) by @​TECHNOFAB11

v1.12.1

Compare Source

• feat: add check-install command (#​1064) by @​mrexox
• chore: only check if local configs exist by @​mrexox
• feat: allow using local config only (#​1071) by @​sj26

v1.12.0

Compare Source

• feat: allow installing only specific hooks (#​1069)
• refactor: [breaking] restructure files and folders, remove deprecated options (#​1067)

v1.11.16

Compare Source

• fix: race condition on repo state (#​1066)

v1.11.15

Compare Source

• feat: add exclude arg (#​1063)
• feat: inherit group envs (#​1061)
• fix: apply implicit staged files filter to all files when all files arg given (#​1062)
• deps: bump github.com/kaptinlin/jsonschema to 0.4.5
• deps: bump github.com/knadh/koanf/parsers/yaml to 1.1.0
• deps: bump github.com/knadh/koanf/v2 to 2.2.1 (#​1043)
• fix: friendlier updater error message
• fix: bump goreleaser

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[changeset-bot]

⚠️ No Changeset found

Latest commit: eb96b14

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
remix-spa-demo	Ready	Preview, Comment	May 29, 2026 9:50am

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	lefthook@​1.11.14 ⏵ 2.1.9	+1

View full report

[ellipsis-dev]

Important

Looks good to me! 👍

Reviewed everything up to 41c1316 in 1 minute and 26 seconds. Click for details.

• Reviewed 16 lines of code in 2 files
• Skipped 0 files when reviewing.
• Skipped posting 1 draft comments. View those below.
• Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.

1. package.json:27

• Draft comment:
  Updating lefthook to v2.0.0 is a major upgrade with breaking changes (e.g., removal of skip_output and regex support in exclude). Ensure your lefthook configuration (e.g., lefthook.yml) is updated accordingly.
• Reason this comment was not posted:
  Decided after close inspection that this draft comment was likely wrong and/or not actionable: usefulness confidence = 0% vs. threshold = 50% This is a dependency version change. Our rules explicitly state "Do NOT comment on dependency changes, library versions that you don't recognize, or anything else related to dependencies." Even though the comment is technically correct about breaking changes, we should trust that the author has already verified compatibility with the new version. The breaking changes in lefthook v2.0.0 could potentially break the build process and git hooks, which might be important enough to warrant keeping the comment despite the rules. Our rules are clear about dependency changes - we should trust the author to handle version upgrades appropriately. If there are breaking changes, they will be discovered during testing or build processes. Delete this comment as it violates our rule about not commenting on dependency changes, regardless of whether breaking changes are involved.

Workflow ID: wflow_rdlNGOmoO17qw28c

^{You can customize by changing your verbosity settings, reacting with 👍 or 👎, replying to comments, or adding code review rules.}

[vercel]

Deployment failed with the following error:

Resource is limited - try again in 2 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/itman?upgradeToPro=build-rate-limit

[vercel]

Deployment failed with the following error:

Resource is limited - try again in 3 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/itman?upgradeToPro=build-rate-limit