chore(deps): update dependency aqua:evilmartians/lefthook to v2.1.15

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
aqua:evilmartians/lefthook	tools	patch	2.1.9 → 2.1.15	2.1.17 (+1)

---

Release Notes

evilmartians/lefthook (aqua:evilmartians/lefthook)

v2.1.15

Compare Source

• fix: do not pipe stdin into post-checkout git-lfs hook (#​1523) by @​rwinkelman
• fix: remove color blending (#​1558) by @​mrexox
• fix: resolve push-files fallback against the remote-tracking ref (#​1485) by @​hamodywe
• test: regression for valid fish shell completion output (#​1527) by @​rwinkelman
• fix: sanitize slashes in remote ref when building the checkout dir name (#​1486) by @​hamodywe
• fix: quote paths in the generated hook shim (#​1509) by @​addielaruee
• feat: propagate forced colors to hook commands via CLICOLOR_FORCE (#​1547) by @​Yash121l

v2.1.14

Compare Source

• fix: error when --job/--command matches nothing (#​1512) by @​nityanand123gupta
• fix: disable tty things when stdout is not TTY (#​1545) by @​mrexox
• docs: document files inheritance for grouped jobs (#​1536) by @​chiliec
• fix: force colors when colors are explicitly enabled (#​1538) by @​Yash121l
• fix: resolve file_types paths from the repo root (#​1537) by @​Yash121l
• fix: don't force-install hooks from the npm postinstall (#​1510) by @​hamodywe
• docs: quote template run examples (#​1472) by @​Guflly

v2.1.13

Compare Source

• fix: error when --job/--command matches nothing (#​1512) by @​nityanand123gupta
• fix: disable tty things when stdout is not TTY (#​1545) by @​mrexox
• docs: document files inheritance for grouped jobs (#​1536) by @​chiliec
• fix: force colors when colors are explicitly enabled (#​1538) by @​Yash121l
• fix: resolve file_types paths from the repo root (#​1537) by @​Yash121l
• fix: don't force-install hooks from the npm postinstall (#​1510) by @​hamodywe
• docs: quote template run examples (#​1472) by @​Guflly

v2.1.12

Compare Source

• fix: fail the hook when staging fixed files errors (#​1484) by @​teddytennant
• fix: LEFTHOOK_OUTPUT precedence (#​1506) by @​Yuki9814
• ci: fix npm publishing by bumping Node to 24 (#​1508) by @​mariokresic

v2.1.11

Compare Source

• fix: inherit terminal size for PTY commands (#​1498) by @​mariokresic
• docs: correct Lefthook commit message configuration (#​1499) by @​codersjj
• docs: hide contributors regenerate tip from the site (#​1500) by @​MikevPeeren
• docs: clarify signed-off commit example (#​1492) by @​nightcityblade
• deps: bump Go to 1.26.6 (#​1495) by @​quaacxlok
• docs: fix em notice by @​mrexox
• docs: update docmd (#​1481) by @​mrexox
• docs: fix EM mention HTML by @​mrexox
• docs: clarify remote script folders (#​1477) by @​scop
• docs: document script args (#​1479) by @​lntutor
• docs: update em logo by @​mrexox

v2.1.10

Compare Source

• deps: July 2026 (#​1463) by @​mrexox
• feat: AI coding agents integration (#​1448) by @​viralpraxis
• docs: fix language (#​1453) by @​pflanze
• fix: make test suite stable when NO_COLOR is set (#​1449) by @​viralpraxis
• deps: June 2026 (#​1447) by @​mrexox
• deps: migrate shellescape to al.essio.dev/pkg/shellescape (#​1443) by @​maguowei
• docs: upgrade docmd (#​1442) by @​mrexox
• docs: use single quotes in example to handle filepaths with $ by @​mrexox

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Version Update: lefthook 2.1.9 → 2.1.15 (patch updates)

Key Changes Across Versions:

v2.1.15 (Latest in this PR):

• Fixed stdin piping issue with post-checkout git-lfs hook
• Removed color blending
• Resolved push-files fallback against remote-tracking ref
• Sanitized slashes in remote ref for checkout dir names
• Added path quoting in generated hook shim
• Propagated forced colors via CLICOLOR_FORCE environment variable

v2.1.14:

• Fixed error handling when --job/--command matches nothing
• Disabled TTY features when stdout is not a TTY
• Fixed color forcing when explicitly enabled
• Resolved file_types paths from repo root
• Prevented force-install hooks from npm postinstall

v2.1.13:

• Same fixes as v2.1.14 (appears to be duplicate changelog entry)

v2.1.12:

• Fixed hook failure when staging fixed files errors
• Fixed LEFTHOOK_OUTPUT precedence
• CI improvements for npm publishing

v2.1.11:

• Inherited terminal size for PTY commands
• Documentation improvements

v2.1.10:

• AI coding agents integration support
• Test suite stability improvements
• Dependency updates

Breaking Changes: None identified

Security Fixes: None explicitly mentioned, but several robustness improvements around path handling and quoting

🎯 Impact Scope Investigation

Configuration Analysis:

The project uses a simple lefthook configuration (lefthook.yml) with:

• pre-commit hooks: fmt, lint, gitleaks, hadolint
• pre-push hooks: gitleaks

Features Used:

• stage_fixed: true (for fmt command)
• glob patterns for file filtering
• run commands with basic command execution
• {staged_files} template variable (hadolint)

Compatibility Assessment:

• No advanced features like interactive, use_stdin, priority, exclude_tags, piped, or pty are used
• All changes in v2.1.10-v2.1.15 are bug fixes and internal improvements
• The fixes for path quoting (v2.1.15) and file_types resolution (v2.1.14) improve robustness
• The stage_fixed feature used in this project benefits from the fix in v2.1.12

Dependency Impact:

• lefthook is a development tool installed via mise/aqua
• No runtime dependencies in the sandbox service itself
• Only affects local development git hooks

Testing Considerations:

• The project uses lefthook in pre-commit hooks (runs go fmt, golangci-lint, gitleaks, hadolint)
• All fixed issues in the changelog are edge cases that don't affect the basic usage patterns in this project

💡 Recommended Actions

Immediate Actions:

1. ✅ Merge this PR - This is a safe patch update with only bug fixes and improvements
2. After merging, developers should run mise install to update their local lefthook installation

No Code Changes Required:

• The existing lefthook.yml configuration is fully compatible
• No API changes or configuration schema updates
• All improvements are backward-compatible

Optional Follow-up:

• Consider updating to v2.1.17 when available (mentioned as pending in the PR)
• Review the AI coding agents integration feature (v2.1.10) if interested in that functionality

Verification Steps:
After merging, verify hooks work correctly:

mise install
lefthook install
git add <some-file>
git commit -m "test"  # Should trigger pre-commit hooks

🔗 Reference Links

• Lefthook Repository
• v2.1.15 Release Notes
• v2.1.14 Release Notes
• v2.1.12 Release Notes
• v2.1.11 Release Notes
• v2.1.10 Release Notes
• PR #86

Generated by koki-develop/claude-renovate-review