chore(deps): bump degit from 2.8.4 to 2.8.6

[dependabot]

Bumps degit from 2.8.4 to 2.8.6.

Changelog

Sourced from degit's changelog.

2.8.6

• Harden git-mode command execution and remote validation.

2.8.5

• Final v2 security patch; keep Node 8 compatibility on the legacy line.
• Node 20 starts with v3.

Commits

• See full diff in compare view

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

[pkg-pr-new]

Open in StackBlitz

@faststore/api

npm i https://pkg.pr.new/vtex/faststore/@faststore/api@90b7745

@faststore/cli

npm i https://pkg.pr.new/vtex/faststore/@faststore/cli@90b7745

@faststore/components

npm i https://pkg.pr.new/vtex/faststore/@faststore/components@90b7745

@faststore/core

npm i https://pkg.pr.new/vtex/faststore/@faststore/core@90b7745

@faststore/diagnostics

npm i https://pkg.pr.new/vtex/faststore/@faststore/diagnostics@90b7745

@faststore/lighthouse

npm i https://pkg.pr.new/vtex/faststore/@faststore/lighthouse@90b7745

@faststore/sdk

npm i https://pkg.pr.new/vtex/faststore/@faststore/sdk@90b7745

@faststore/ui

npm i https://pkg.pr.new/vtex/faststore/@faststore/ui@90b7745

commit: 90b7745

[renatomaurovtex]

Review — chore(deps): bump degit 2.8.4 → 2.8.6

Lockfile-only, in-range patch bump (packages/cli declares degit: ^2.8.4, no manifest change needed). Verified the substance:

• Dependency Discipline: degit is a runtime dep of the published @faststore/cli, but this is an in-range patch of an existing dep — no new dependency, no checklist needed.
• Security-relevant: 2.8.5/2.8.6 are security patches on the legacy v2 line ("harden git-mode command execution and remote validation"). Our exposure is low — create.ts clones the hardcoded vtex-sites/starter.store in default tar mode, no user-controlled repo spec and no git mode — but the hardening is free. Merge-worthy.
• Zero transitive impact: degit bundles its dependencies (degit@2.8.6: {} in the lockfile), so nothing else in the tree moves.
• Churn (±10k/−17k): all quote-style reflow (" → ') — the lockfile flipping back from prettier-formatted to pnpm-native format, same pattern as #3416/#3418. The real diff is 2 lines. Standing suggestion from #3416 still applies: exclude pnpm-lock.yaml from prettier so these PRs stay readable.

💬 [nit] Forward-looking: degit's changelog notes the v2 line is legacy Node-8-compatible and "Node 20 starts with v3". Since @faststore/cli already requires node >=20, moving to degit v3 at some point would keep us on the maintained line — out of scope here.

CI: the red FastStore check is the "Publish to Chromatic" step only (missing project token on dependabot PRs — known pattern, #3361); the parallel FastStore job, SonarQube, codesandbox, and the node-ci pipeline are all green.

Verdict: Approved

Blocking (🔴/🟠):

• None

Non-blocking (🟡/💬):

• 💬 Consider degit v3 (maintained line for Node ≥20) in a follow-up.
• 💬 Exclude pnpm-lock.yaml from prettier to stop the ±10k reflow churn on dependabot PRs.

Checks to confirm before merge: none beyond current CI — lockfile-only, no published package code touched (Chromatic red is the dependabot token pattern, not a regression).

[sonar-workflows]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• No data about coverage (36.30% Estimated after merge)
• No data about duplications (1.40% Estimated after merge)

Project ID: vtex_faststore_f0a862d5-9557-49f9-8d09-de40caa76622

View in SonarQube