chore(deps): update dependencies and migrate to changesets v3

[alexander-akait]

Summary

Updates the dev toolchain to the latest versions the declared ranges allow and, in doing so, repairs the release workflow: the pinned changesets/action@v2.1.1 only supports @changesets/cli v3 and rejects the v1-style inputs (version, publish, commit, title) the workflow still passed, so the release job could not have run as it was. This bumps @changesets/cli 2.31.0 → 3.0.2, @changesets/get-github-info 0.8.0 → 1.0.1, @codspeed/core 5.6.0 → 5.7.1 and changesets/action → v2.1.2, renames the workflow inputs to the v2 ones, ports the changelog generator to the renamed getCommitInfo/getPullRequestInfo API and its new return shape, and refreshes the remaining deps in the lockfile (prettier 3.9.6, cspell 10.3.0, webpack 5.110.3, memfs 4.75.0, lint-staged 17.5.1, tinybench 6.2.0, eslint 9.39.5, @types/node 24.13.4).

The obsolete GITHUB_TOKEN/NPM_TOKEN env entries are dropped from the release job: the action injects GITHUB_TOKEN into the version/publish scripts itself (and errors when the env var disagrees with the github-token input), and CLI v3 no longer performs the npm auth check the empty NPM_TOKEN worked around. .changeset/README.md and the config $schema follow the v3 templates, and import/no-unresolved is disabled for .changeset/*.mjs because eslint-plugin-import's node resolver cannot follow the now exports-only ESM package.

Three deps are deliberately held back: tooling (v1.26.4 → v1.28.1) because the release tarball host was unreachable from the environment this was prepared in, so no valid lockfile integrity could be produced; eslint 10 because eslint-plugin-import, pulled in by eslint-config-webpack, still caps at eslint ^9; and @types/node 25/26 because both change the lstatSync/readFileSync overloads and break lint:types against the ReadFileSync/SyncFileSystem typedefs in lib/Resolver.js.

What kind of change does this PR introduce?

chore — dependency and CI/release tooling updates, no library code touched.

Did you add tests for your changes?

n/a — no library code changed; the existing suite (1522 tests), lint, lint:special, fmt:check, lint:spellcheck and the browser smoke bundle all pass, and the release path was exercised locally with changeset status/changeset version plus a stubbed get-github-info covering every branch of the changelog generator.

Does this PR introduce a breaking change?

No — devDependencies and CI only; the published package and its runtime deps are unchanged.

If relevant, what needs to be documented once your changes are merged or what have you already documented?

n/a

Use of AI

Written with Claude Code: it ran the dependency resolution and upgrade checks, ported the changelog generator, updated the release workflow, and ran the lint/test/release verification described above. All changes were reviewed against the upstream changesets v3 and action v2 sources.

🤖 Generated with Claude Code

https://claude.ai/code/session_01K1wTTg6qPS3sGF9K9987am

---

Generated by Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 0d77410

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ Unknown (99a7222)
• ✅ login: alexander-akait / name: Alexander Akait (0d77410, 99a7222)

One or more co-authors of this pull request were not found. You must specify co-authors in commit message trailer via:

Co-authored-by: name <email>

Supported Co-authored-by: formats include:

1. Anything <id+login@users.noreply.github.com> - it will locate your GitHub user by id part.
2. Anything <login@users.noreply.github.com> - it will locate your GitHub user by login part.
3. Anything <public-email> - it will locate your GitHub user by public-email part. Note that this email must be made public on Github.
4. Anything <other-email> - it will locate your GitHub user by other-email part but only if that email was used before for any other CLA as a main commit author.
5. login <any-valid-email> - it will locate your GitHub user by login part, note that login part must be at least 3 characters long.

Alternatively, if the co-author should not be included, remove the Co-authored-by: line from the commit message.

Please update your commit message(s) by doing git commit --amend and then git push [--force] and then request re-running CLA check via commenting on this pull request:

/easycla

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	eslint@​9.39.4 ⏵ 9.39.5
	@​changesets/​cli@​2.31.0 ⏵ 3.0.2	+2		-25	+3
	@​types/​node@​24.13.1 ⏵ 24.13.4	+1		+1	+2
	@​codspeed/​core@​5.6.0 ⏵ 5.7.1			+1
	@​changesets/​get-github-info@​0.8.0 ⏵ 1.0.1	+2		-8	+3
	webpack@​5.107.2 ⏵ 5.110.3	+12		+1
	memfs@​4.57.8 ⏵ 4.75.0			+1
	prettier@​3.8.4 ⏵ 3.9.6			+1
	cspell@​10.0.1 ⏵ 10.3.0				+6
	lint-staged@​17.0.8 ⏵ 17.5.1				+1
	tinybench@​6.0.2 ⏵ 6.2.0	+1		+1	+7

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.14%. Comparing base (70f60e7) to head (0d77410).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #665   +/-   ##
=======================================
  Coverage   98.14%   98.14%           
=======================================
  Files          49       49           
  Lines       10018    10018           
=======================================
  Hits         9832     9832           
  Misses        186      186           

Flag	Coverage Δ
integration	98.14% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[alexander-akait]

Status on the two red checks:

lint — fixed in f56731d. lint:special failed with types.d.ts need to be updated: prettier 3.9 formats short unions on one line instead of breaking them with a leading |, so the committed generated types no longer matched the generator's output. Regenerated with npm run fix:special — whitespace only, no type changes. Full npm run lint and the test suite (1522 tests) pass locally on the new head.

EasyCLA — not something I can fix from here. Both commits are authored by Claude <noreply@anthropic.com>, which isn't covered by a signed CLA, and the Co-Authored-By trailer on the first commit isn't resolvable to a GitHub user either (that trailer is gone from the second commit). The fix is to rewrite the authorship on this branch:

git rebase -i --root  # or: git commit --amend --author="Name <email>" per commit
git push --force-with-lease

then re-run the check by commenting /easycla. My sandbox blocks amending author metadata and force-pushing, so this one needs a maintainer. Everything else on the branch is ready.

---

Generated by Claude Code

[alexander-akait]

/easycla

---

Generated by Claude Code

[codspeed]

Merging this PR will improve performance by 15.12%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 2 improved benchmarks
✅ 140 untouched benchmarks

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
⚡	Simulation	realistic-midsize: mixed batch (cold cache)	18.3 ms	15.5 ms	+18.66%
⚡	Memory	node-compare: node require.resolve x 1000	85.3 KB	76.4 KB	+11.68%

Tip

Curious why performance improved? Comment @codspeedbot explain why performance improved on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing claude/update-deps-release-workflow-gbdbwm (0d77410) with main (70f60e7)}