chore(deps): update dependency aqua:evilmartians/lefthook to v2.2.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
aqua:evilmartians/lefthook	tools	minor	2.1.9 → 2.2.0	2.2.2 (+1)

---

Release Notes

evilmartians/lefthook (aqua:evilmartians/lefthook)

v2.2.0

Compare Source

• fix: don't write an install-time lefthook path into AI hook configs (#​1544) by @​anandghegde
• docs: publish JSON schema at lefthook.dev/schema.json (#​1579) by @​BUTTERFINGERS7498
• fix: pass --output path to git diff as a single argument (#​1581) by @​cpruijsen
• fix: ignore trailing NUL in --files-from-stdin (#​1574) by @​jasonwbarnett
• deps: October 2026 (#​1571) by @​mrexox

v2.1.17

Compare Source

Changelog

• 8d8073d fix: diff push files against the merge base with the default branch (#​1565)
• c12bccd fix: don't hash submodules when checking fail_on_changes (#​1566)
• 03225ef refactor: naming of helpers (#​1568)
• 66746ac refactor: working with git (#​1564)

v2.1.16

Compare Source

• fix: test staging fixed files with partially staged by @​mrexox
• fix: preserve unrelated unstaged changes on conflict (#​1483) by @​Sakshamm-Goyal
• deps: bump mod and text deps to resolve CVEs (#​1560) by @​devindavies
• ci: refactor publishing scripts (#​1559) by @​mrexox

v2.1.15

Compare Source

• fix: do not pipe stdin into post-checkout git-lfs hook (#​1523) by @​rwinkelman
• fix: remove color blending (#​1558) by @​mrexox
• fix: resolve push-files fallback against the remote-tracking ref (#​1485) by @​hamodywe
• test: regression for valid fish shell completion output (#​1527) by @​rwinkelman
• fix: sanitize slashes in remote ref when building the checkout dir name (#​1486) by @​hamodywe
• fix: quote paths in the generated hook shim (#​1509) by @​addielaruee
• feat: propagate forced colors to hook commands via CLICOLOR_FORCE (#​1547) by @​Yash121l

v2.1.14

Compare Source

• fix: error when --job/--command matches nothing (#​1512) by @​nityanand123gupta
• fix: disable tty things when stdout is not TTY (#​1545) by @​mrexox
• docs: document files inheritance for grouped jobs (#​1536) by @​chiliec
• fix: force colors when colors are explicitly enabled (#​1538) by @​Yash121l
• fix: resolve file_types paths from the repo root (#​1537) by @​Yash121l
• fix: don't force-install hooks from the npm postinstall (#​1510) by @​hamodywe
• docs: quote template run examples (#​1472) by @​Guflly

v2.1.13

Compare Source

• fix: error when --job/--command matches nothing (#​1512) by @​nityanand123gupta
• fix: disable tty things when stdout is not TTY (#​1545) by @​mrexox
• docs: document files inheritance for grouped jobs (#​1536) by @​chiliec
• fix: force colors when colors are explicitly enabled (#​1538) by @​Yash121l
• fix: resolve file_types paths from the repo root (#​1537) by @​Yash121l
• fix: don't force-install hooks from the npm postinstall (#​1510) by @​hamodywe
• docs: quote template run examples (#​1472) by @​Guflly

v2.1.12

Compare Source

• fix: fail the hook when staging fixed files errors (#​1484) by @​teddytennant
• fix: LEFTHOOK_OUTPUT precedence (#​1506) by @​Yuki9814
• ci: fix npm publishing by bumping Node to 24 (#​1508) by @​mariokresic

v2.1.11

Compare Source

• fix: inherit terminal size for PTY commands (#​1498) by @​mariokresic
• docs: correct Lefthook commit message configuration (#​1499) by @​codersjj
• docs: hide contributors regenerate tip from the site (#​1500) by @​MikevPeeren
• docs: clarify signed-off commit example (#​1492) by @​nightcityblade
• deps: bump Go to 1.26.6 (#​1495) by @​quaacxlok
• docs: fix em notice by @​mrexox
• docs: update docmd (#​1481) by @​mrexox
• docs: fix EM mention HTML by @​mrexox
• docs: clarify remote script folders (#​1477) by @​scop
• docs: document script args (#​1479) by @​lntutor
• docs: update em logo by @​mrexox

v2.1.10

Compare Source

• deps: July 2026 (#​1463) by @​mrexox
• feat: AI coding agents integration (#​1448) by @​viralpraxis
• docs: fix language (#​1453) by @​pflanze
• fix: make test suite stable when NO_COLOR is set (#​1449) by @​viralpraxis
• deps: June 2026 (#​1447) by @​mrexox
• deps: migrate shellescape to al.essio.dev/pkg/shellescape (#​1443) by @​maguowei
• docs: upgrade docmd (#​1442) by @​mrexox
• docs: use single quotes in example to handle filepaths with $ by @​mrexox

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

This PR updates lefthook from v2.1.9 to v2.2.0, a minor version bump that includes the following changes across 11 intermediate versions:

Major Changes:

• JSON schema now published at lefthook.dev/schema.json for configuration validation
• PHP Composer package manager support added (not relevant to this Go project)
• AI coding agents integration support added in v2.1.10

Bug Fixes (Relevant to this project):

• Fixed stdin piping issues with post-checkout hooks (v2.1.15)
• Corrected git diff argument handling for output path specification (v2.2.0)
• Fixed trailing NUL character handling in --files-from-stdin (v2.2.0)
• Disabled TTY features when stdout is not a terminal (v2.1.14)
• Fixed path quoting in generated hook shims to handle special characters (v2.1.15)
• Fixed stage_fixed functionality when staging fixed files encounters errors (v2.1.12)
• Fixed file_types path resolution from repository root (v2.1.14)

Security Fixes:

• Dependency updates resolving CVEs (v2.1.16)
• Regular dependency updates for October 2026 (v2.2.0)

Breaking Changes:

• None identified. All changes are backward compatible.

🎯 Impact Scope Investigation

Usage Location Analysis:

• Lefthook is defined in mise.toml:4 as a development tool
• Configuration exists in lefthook.yml with pre-commit and pre-push hooks
• Current configuration uses basic features:
  • stage_fixed: true (used by fmt command) - Fixed in v2.1.12
  • glob patterns for file matching
  • Simple run commands
  • {staged_files} template variable
• No advanced features used (no files_from_stdin, interactive, piped, remote, etc.)

Hook Commands:

1. pre-commit:

   • go fmt ./... with stage_fixed
   • golangci-lint run
   • gitleaks git --pre-commit --staged
   • hadolint {staged_files}

2. pre-push:

   • gitleaks git

Impact on Dependencies:

• No impact on other dependencies
• Installed via aqua (mise tool version manager)
• No Go module dependencies affected

Configuration Compatibility:

• Current lefthook.yml configuration is fully compatible with v2.2.0
• No configuration format changes required
• Bug fixes actually improve the reliability of existing stage_fixed feature

💡 Recommended Actions

Immediate Actions:

• ✅ Safe to merge immediately - No code changes or configuration updates required
• The update is backward compatible and includes bug fixes that improve stability

Post-Merge Actions:

1. Run mise install to update lefthook to v2.2.0
2. Verify hooks work correctly by triggering a commit (the stage_fixed fix in v2.1.12 should improve reliability)
3. No migration steps needed

Benefits of Upgrading:

• Improved reliability of stage_fixed: true feature used by the fmt command
• Better handling of file paths with special characters in hook scripts
• Security improvements from dependency updates (CVE fixes in v2.1.16)
• Better TTY handling for CI/CD environments
• More stable git operations

🔗 Reference Links

• Pull Request
• v2.2.0 Release Notes
• CHANGELOG
• Lefthook Repository

Generated by koki-develop/claude-renovate-review