[vannt-dev]

Nothing keeps the tool versions the standard writes into a repository up to date: Dependabot watches package.json and the uses: lines of the workflows, not TOOL_VERSIONS. Checked against the registries, two had fallen behind:

Tool	Was	Now	Where it shows
lefthook	2.1.14	2.2.1	the ^ range in a Node.js project's package.json; npx --yes lefthook@… install in CONTRIBUTING.md and in the hint after init
Renovate	44.128.1	44.149.2	the image of the renovate job on GitLab

Everything else is current: commitlint, semantic-release and its plugins, shfmt, PSScriptAnalyzer. conventional-changelog-conventionalcommits stays at 9.3.1 on purpose (the comment beside it says why).

Generated output changes for every repository, so the standard moves to 1.4.4. A repository only sees it when it runs repokeeper update with the new version; its drift check keeps running the version that wrote its standard.

A hint that was missing

Moving the lefthook range is the first time update changes package.json and nothing else, and it leaves the lockfile behind: npm ci then stops with "package.json and package-lock.json are not in sync". update now says so:

write      package.json (devDependencies.lefthook)
next: package.json changed; install dependencies and commit the lockfile with it

This repository is the first to need it: it is updated to 1.4.4 here, with its lockfile.

Tested

With this build packed and installed as the published package would be:

• lefthook 2.2.1, a Python project: init, then npx --yes lefthook@2.2.1 install: the three hooks are installed; a commit with a bad subject is refused by commitlint, a good one goes through.
• lefthook 2.2.1, a Node.js project taken from the published 0.8.1: update writes the range and prints the hint; after npm install a bad subject is refused, a good one accepted, and the pre-push hook runs the tests.
• The lockfile, on this repository: after update, npm ci failed with the message above while the lockfile still named 2.1.17; after npm install, it passes. The lockfile was regenerated with the current npm so that only the lefthook entries move.
• A range the user had edited: reported as a conflict and left alone, as designed.
• Every fixture on both platforms, published 0.8.1 against this build (26 projects): each differs by .repokeeper.yml and the lock; projects without Node.js also by CONTRIBUTING.md; Node.js projects by package.json; GitLab projects also by .gitlab-ci.yml. Nothing else.
• lefthook's release notes from 2.1.15 to 2.2.1: fixes and small additions, nothing about the configuration the standard writes.
• npm run lint, npm run typecheck, npm test (430 tests), repokeeper check on this repository.

Not tested

• Renovate 44.149.2 has not run. The tag exists on Docker Hub and it is the version Renovate itself proposed on the pilot. Its first run is the pilot's weekly schedule (Mondays 05:00 UTC), or the Run button on that schedule, once the pilot is updated.
• pnpm and yarn projects: the hint names no package manager, and only npm's frozen install was seen failing.

Also

• Three tests named the versions as literals; they read them from TOOL_VERSIONS now, so the next move is one file.
• biome.json named the schema of 2.5.14 after the move to 2.5.15 this morning; biome said so on every run.
• The playground's standard and the version it asks for (0.8.2, the first that knows 1.4.4) move with it. Until 0.8.2 is on npm, the live playground asks for a version that is not out yet.

Seen on the way, not changed

• npm 12 does not run a dependency's install script until it is approved (npm install-scripts approve). "Install dependencies; this installs the git hooks" relies on lefthook's install script, so it will need another look when npm 12 is what people have.
• The same gap as above exists inside the reusable workflows: npm install @commitlint/cli@… in commitlint.yml and the shfmt and PSScriptAnalyzer versions in stack-script.yml are not watched by anything either. They are current today.

🤖 Generated with Claude Code