chore(deps): weekly CLI dependency update (2026-07-17) [RED-709]

Bump the direct dependencies whose latest version is both compatible with
our Node 20.19.0 floor and past pnpm's 2-day release-age embargo:

  mqtt                                  5.15.1  -> 5.15.2
  string-width                          8.2.1   -> 8.2.2
  @typescript-eslint/typescript-estree  8.62.1  -> 8.64.0
  oclif                                 4.23.24 -> 4.23.27
  tar                                   7.5.19  -> 7.5.20
  eslint                                10.6.0  -> 10.7.0
  typescript-eslint                     8.62.1  -> 8.64.0
  vitest                                3.2.6   -> 3.2.7

Held back — newest major raises the minimum Node above our floor, and each
is already at its latest installable version, so no manifest change:

  @commitlint/cli, @commitlint/config-conventional  21.x needs >=22.12.0
  lint-staged                                       17.x needs >=22.22.1
  nanoid                                            6.x  needs ^22 || ^24 || >=26

Deferred: typescript stays at 6.0.3. 7.0.2 clears both gates, but
TypeScript 7 is the native port and typescript-eslint 8.64.0 declares peer
typescript ">=4.8.4 <6.1.0", so it would break the lint toolchain. Tracked
separately.

Excluded: @types/node, deliberately held near our minimum supported Node
major so code cannot reach for APIs missing on the oldest Node we support.

Nothing was blocked by the release-age embargo this week.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sorccu

package.json

@@ -16,12 +16,12 @@
     "@commitlint/config-conventional": "^20.5.3",
     "@eslint/js": "^10.0.1",
     "@stylistic/eslint-plugin": "^5.10.0",
-    "eslint": "^10.6.0",
+    "eslint": "^10.7.0",
     "globals": "^17.7.0",
     "lint-staged": "^16.4.0",
     "rimraf": "^6.1.3",
     "simple-git-hooks": "^2.13.1",
-    "typescript-eslint": "^8.62.1"
+    "typescript-eslint": "^8.64.0"
   },
   "simple-git-hooks": {
     "commit-msg": "pnpm exec commitlint --edit",

packages/cli/package.json

@@ -112,7 +112,7 @@
     "@oclif/core": "^4.11.14",
     "@oclif/plugin-help": "^6.2.53",
     "@oclif/plugin-warn-if-update-available": "^3.1.68",
-    "@typescript-eslint/typescript-estree": "^8.62.1",
+    "@typescript-eslint/typescript-estree": "^8.64.0",
     "acorn": "^8.17.0",
     "acorn-walk": "^8.3.5",
     "archiver": "^8.0.0",
@@ -136,15 +136,15 @@
     "log-symbols": "^7.0.1",
     "luxon": "^3.7.2",
     "minimatch": "^10.2.5",
-    "mqtt": "^5.15.1",
+    "mqtt": "^5.15.2",
     "open": "^11.0.0",
     "p-queue": "^9.3.1",
     "prompts": "^2.4.2",
     "proxy-from-env": "^2.1.0",
     "recast": "^0.23.12",
     "semver": "^7.8.5",
     "socks-proxy-agent": "^10.1.0",
-    "string-width": "^8.2.1",
+    "string-width": "^8.2.2",
     "uuid": "^14.0.1",
     "yaml": "^2.9.0"
   },
@@ -160,10 +160,10 @@
     "config": "^4.4.2",
     "cross-env": "^10.1.0",
     "nanoid": "^5.1.16",
-    "oclif": "^4.23.24",
+    "oclif": "^4.23.27",
     "rimraf": "^6.1.3",
-    "tar": "^7.5.19",
+    "tar": "^7.5.20",
     "typescript": "^6.0.3",
-    "vitest": "^3.2.6"
+    "vitest": "^3.2.7"
   }
 }

packages/create-cli/package.json

@@ -78,6 +78,6 @@
     "rimraf": "^6.1.3",
     "typescript": "^6.0.3",
     "uuid": "^14.0.1",
-    "vitest": "^3.2.6"
+    "vitest": "^3.2.7"
   }
 }