build(dev-deps): bump lint-staged to 17.5.1

[dsanders11]

Drops transitive dependencies.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	lint-staged@​16.2.7 ⏵ 17.5.1	+1

View full report

[claude]

The private-registry resolution issue I flagged earlier has been fixed — the lockfile now resolves lint-staged, picomatch, tinyexec, and yaml against the public registry with no __archiveUrl mirror suffix. LGTM: a clean devDependency bump (lint-staged ^16.2.7 → ^17.5.1) with a correctly regenerated yarn.lock.

Extended reasoning...

Overview

This PR bumps the lint-staged devDependency from ^16.2.7 to ^17.5.1 in package.json, with a corresponding yarn.lock regeneration. Only these two files are touched; no application code, config, or tests changed.

Follow-up on prior finding

My earlier review (posted on a previous push of this PR) flagged that yarn.lock resolutions for lint-staged, picomatch, tinyexec, and yaml embedded __archiveUrl=https://ms-feed-25.pkgs.visualstudio.com/... — evidence the lockfile had been generated against a private Azure DevOps registry mirror rather than the public npm registry, which would break installs for contributors/CI without access to that internal feed. Checking the current HEAD (commit b755c3a, pushed after that review), the lockfile has been regenerated: resolution: "lint-staged@ npm:17.5.1", resolution: "picomatch@ npm:4.0.7", resolution: "tinyexec@ npm:1.3.1" are now clean, with no __archiveUrl or pkgs.visualstudio.com references anywhere in the file (grep confirms zero matches). This directly addresses the previously raised concern.

Security risks

None. This is a devDependency-only change (lint-staged is a git-hooks lint runner, not shipped in production code), and the lockfile now correctly points at the public registry.

Level of scrutiny

Low. This is a mechanical, single-purpose version bump with a correctly regenerated lockfile, and the one substantive issue found on a prior pass of this PR has since been fixed.

Other factors

No outstanding review threads or CHANGES_REQUESTED reviews from other parties are indicated in the timeline. The socket-security bot comment is a third-party automated scan with no text visible to me here, but it predates the lockfile fix commit and the corrected resolutions now checked directly rule out the specific supply-chain concern (private mirror URLs) that was previously raised.