build(deps-dev): Bump @changesets/cli from 2.31.1 to 3.0.1

[dependabot]

Bumps @changesets/cli from 2.31.1 to 3.0.1.

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​3.0.1

Patch Changes

• #2239 fdfdc93 Thanks @​bluwy! - Update links in default generated .changeset/README.md file
• Updated dependencies [d0386b6]:
  • @​changesets/write@​1.0.1

@​changesets/cli@​3.0.0

Major Changes

• #2128 7113c01 Thanks @​Andarist! - Renamed the changeset tag command to changeset git-tag.

• #2074 3599e47 Thanks @​bluwy! - Set supported package manager versions in "engines" field, including npm >=10.9.0, pnpm >=10.0.0, and yarn >=4.5.2.

• #1860 92b1c1b Thanks @​mixelburg! - changeset version now exits with code 1 when there are no unreleased changesets, instead of silently exiting with code 0.

  This makes it easier to detect when a version step is a no-op — for example, to prevent accidentally publishing packages with incorrect version tags when using --snapshot mode.

• #1482 df424a4 Thanks @​Andarist! - Bumped supported Node versions to ^22.11 || ^24 || >=26

• #1994 062530b Thanks @​bluwy! - The prettier option in .changeset/config.json has been removed in favor of format. format supports "auto", "prettier", "oxfmt", "deno", and "dprint", and false disables formatting. If you previously used prettier: false, migrate to format: false or remove the option to use automatic formatter detection.

• #2190 96b65ee Thanks @​bluwy! - Move versioned prerelease changesets to .changeset/pre/ folder instead of accumulating in the root and tracking the versioned changeset ids in the .changeset/pre.json file. Existing pre.json will auto-migrate to this new structure on the next run of changeset version or when calling changeset status.

  This change allows easier management of versioned prerelease changesets (for the final stable release) and current queued changesets (for the next prerelease). Changesets in .changeset/pre/ can be edited or deleted depending if it's still relevant for the final stable release of a package. There's no need to synchronize the changeset ids in pre.json if certain changesets are deleted.

• #2145 f5887ff Thanks @​Andarist! - Removed Yarn Classic support

• #2097 8c88f6a Thanks @​Andarist! - Packages with only prerelease versions published will now be published with the prerelease tag in the prerelease mode if the target registry doesn't auto-assign latest tag. npm registry itself does that and such packages will continue to be released with latest tag (and not with the configured prerelease tag).

• #1879 c76b232 Thanks @​beeequeue! - Removed warning messages about using v1 configs. They will now be silently ignored.

• #1655 db46911 Thanks @​bluwy! - Update @manypkg/get-packages which drops support for detecting packages in Bolt monorepos and adds support for npm monorepos

• #1651 e1df862 Thanks @​bluwy! - Remove support for the --sinceMaster flag for changeset status. Use --since=master or --since=main instead.

• #2117 813bbf3 Thanks @​bluwy! - Remove the pre.json initialVersions property and handling as it's unused internally

• #1961 07278a7 Thanks @​beeequeue! - CommitFunctions can now be both sync and async, and the defaultCommitFunctions are now sync.

• #1482 df424a4 Thanks @​Andarist! - From now on this package is going to be published as ES module.

• #1652 a0b5326 Thanks @​bluwy! - Remove support for the deprecated ___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH.useCalculatedVersionForSnapshots config. The snapshot.useCalculatedVersion config should be used instead.

• #2186 3910adf Thanks @​Andarist! - Private packages are no longer versioned by default. Set privatePackages to true to opt into versioning and tagging them, or set privatePackages.version to true to version them without tagging.

• #1879 c76b232 Thanks @​beeequeue! - Migrated from enquirer + @inquirer/launch-editor to @clack/prompts + launch-editor.

  This means the CLI flows will have minor changes, but they are largely the same.

... (truncated)

Changelog

Sourced from @​changesets/cli's changelog.

3.0.1

Patch Changes

• #2239 fdfdc93 Thanks @​bluwy! - Update links in default generated .changeset/README.md file
• Updated dependencies [d0386b6]:
  • @​changesets/write@​1.0.1

3.0.0

Major Changes

• #2128 7113c01 Thanks @​Andarist! - Renamed the changeset tag command to changeset git-tag.

• #2074 3599e47 Thanks @​bluwy! - Set supported package manager versions in "engines" field, including npm >=10.9.0, pnpm >=10.0.0, and yarn >=4.5.2.

• #1860 92b1c1b Thanks @​mixelburg! - changeset version now exits with code 1 when there are no unreleased changesets, instead of silently exiting with code 0.

  This makes it easier to detect when a version step is a no-op — for example, to prevent accidentally publishing packages with incorrect version tags when using --snapshot mode.

• #1482 df424a4 Thanks @​Andarist! - Bumped supported Node versions to ^22.11 || ^24 || >=26

• #1994 062530b Thanks @​bluwy! - The prettier option in .changeset/config.json has been removed in favor of format. format supports "auto", "prettier", "oxfmt", "deno", and "dprint", and false disables formatting. If you previously used prettier: false, migrate to format: false or remove the option to use automatic formatter detection.

• #2190 96b65ee Thanks @​bluwy! - Move versioned prerelease changesets to .changeset/pre/ folder instead of accumulating in the root and tracking the versioned changeset ids in the .changeset/pre.json file. Existing pre.json will auto-migrate to this new structure on the next run of changeset version or when calling changeset status.

  This change allows easier management of versioned prerelease changesets (for the final stable release) and current queued changesets (for the next prerelease). Changesets in .changeset/pre/ can be edited or deleted depending if it's still relevant for the final stable release of a package. There's no need to synchronize the changeset ids in pre.json if certain changesets are deleted.

• #2145 f5887ff Thanks @​Andarist! - Removed Yarn Classic support

• #2097 8c88f6a Thanks @​Andarist! - Packages with only prerelease versions published will now be published with the prerelease tag in the prerelease mode if the target registry doesn't auto-assign latest tag. npm registry itself does that and such packages will continue to be released with latest tag (and not with the configured prerelease tag).

• #1879 c76b232 Thanks @​beeequeue! - Removed warning messages about using v1 configs. They will now be silently ignored.

• #1655 db46911 Thanks @​bluwy! - Update @manypkg/get-packages which drops support for detecting packages in Bolt monorepos and adds support for npm monorepos

• #1651 e1df862 Thanks @​bluwy! - Remove support for the --sinceMaster flag for changeset status. Use --since=master or --since=main instead.

• #2117 813bbf3 Thanks @​bluwy! - Remove the pre.json initialVersions property and handling as it's unused internally

• #1961 07278a7 Thanks @​beeequeue! - CommitFunctions can now be both sync and async, and the defaultCommitFunctions are now sync.

• #1482 df424a4 Thanks @​Andarist! - From now on this package is going to be published as ES module.

• #1652 a0b5326 Thanks @​bluwy! - Remove support for the deprecated ___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH.useCalculatedVersionForSnapshots config. The snapshot.useCalculatedVersion config should be used instead.

• #2186 3910adf Thanks @​Andarist! - Private packages are no longer versioned by default. Set privatePackages to true to opt into versioning and tagging them, or set privatePackages.version to true to version them without tagging.

• #1879 c76b232 Thanks @​beeequeue! - Migrated from enquirer + @inquirer/launch-editor to @clack/prompts + launch-editor.

... (truncated)

Commits

• bed4581 Version Packages (#2242)
• fdfdc93 Update default generated readme (#2239)
• d5f5ae8 Fix Windows PTY snapshot normalization (#2233)
• f442221 Version Packages (#2235)
• e3facad Version Packages (next) (#2228)
• c98af4c Do not bump ignored independent packages when exiting pre mode (#2092)
• 496ca21 Build(deps-dev): Bump the development-dependencies group with 6 updates (#2225)
• d1053ac Build(deps): Bump the production-dependencies group across 1 directory with 2...
• 68ea6ec Fix linked and fixed glob patterns expansion (#2222)
• c1b6f8c fix missing coloring of name (#2218)
• Additional commits viewable in compare view

[chitcommit]

This PR fixes the high-severity js-yaml advisory that is currently failing gates / dependency-audit on every open PR.

Verified by simulating the bump against a fresh lockfile (--package-lock-only, no node_modules mutation):

before:  node_modules/js-yaml                          4.3.1   (vulnerable: 4.0.0 - 4.3.1)
         node_modules/read-yaml-file/node_modules/js-yaml  3.15.1  (vulnerable: 3.0.0 - 3.15.1)
         npm audit --audit-level=high  -> exit 1   (3 vulns: 2 moderate, 1 high)

after @changesets/cli@3.0.1:
         js-yaml entries in lockfile: 0
         npm audit --audit-level=high  -> exit 0   (2 moderate remaining)

Why nothing smaller works. @changesets/parse pinned js-yaml ^4.1.1, and the newest release inside that range is 4.3.1 — which is itself vulnerable. There is no in-range patch, so a lockfile refresh cannot fix it (confirmed: npm install --package-lock-only leaves 4.3.1 in place). The current @changesets/parse@1.0.0 has no js-yaml dependency at all, so this bump drops the dependency rather than patching it.

I started a separate branch for this and closed it once the simulation showed #159 already covers it — flagging here instead of opening a competing PR.

Remaining after merge: 2 moderate (qs, covered by #162; and hono). Neither trips the high-severity gate.