build(deps-dev): bump lint-staged from 16.2.7 to 17.4.1

[claude]

Before: lint-staged is pinned at ^16.2.7, which pulls in a large transitive tree into yarn.lock.

After: lint-staged is ^17.4.1, which drops most of that tree, thinning yarn.lock by 255 lines (+32/−287).

Part of an ecosystem-wide bump requested by @dsanders11 (see the earlier batch in the other electron repos).

How: bumped the devDependency and regenerated yarn.lock with the repo's pinned Yarn (4.10.3); no other dependencies changed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FYHE9pAHKgNagai4AYyBbH

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	lint-staged@​16.2.7 ⏵ 17.4.1	+1

View full report

[claude]

Looks good, straightforward devDependency version bump. Reviewed the package.json diff (lint-staged ^16.2.7 to ^17.4.1) and the yarn.lock regeneration — the removed transitive packages (ansi-escapes, cli-cursor, cli-truncate, commander, listr2, etc.) line up with lint-staged v17 dropping those deps upstream. No source or config logic changes.

Extended reasoning...

Overview

This PR only touches package.json (bumping the devDependency lint-staged from ^16.2.7 to ^17.4.1) and yarn.lock (the corresponding lockfile regeneration, dropping ~255 net lines of transitive dependency entries). No application source code, build scripts, or CLAUDE.md files are modified.

Security risks

None identified. This is a devDependency (used for pre-commit linting, not shipped in the runtime bundle), and the version bump is a normal semver-compatible major-version update within lint-staged's own release cadence. The removed transitive packages (ansi-escapes, ansi-regex, ansi-styles, braces, cli-cursor, cli-truncate, commander, emoji-regex, etc.) are consistent with lint-staged v17 trimming its own dependency tree, not with any suspicious substitution.

Level of scrutiny

Low. This is a mechanical, single-package version bump with an auto-generated lockfile diff, no logic changes, and it only affects the local dev/lint tooling. A candidate concern about the repo's npmMinimalAgeGate: 10080 setting in .yarnrc.yml potentially blocking resolution of newly-published transitive versions was already investigated and ruled out in an earlier pass (the lockfile update succeeded, so it wasn't blocked in practice).

Other factors

No CODEOWNERS restriction applies, and no outstanding review comments or CHANGES_REQUESTED reviews exist in the timeline for this PR. The bug hunter reported zero findings, and my own review of the diff found nothing beyond what was already ruled out.