[Snyk] Security upgrade @release-it/conventional-changelog from 9.0.4 to 10.0.2

[lposen]

Snyk has created this PR to fix 9 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• package.json
• yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Access of Resource Using Incompatible Type ('Type Confusion') SNYK-JS-HANDLEBARS-15803084	278
	Access of Resource Using Incompatible Type ('Type Confusion') SNYK-JS-HANDLEBARS-15803082	255
	Access of Resource Using Incompatible Type ('Type Confusion') SNYK-JS-HANDLEBARS-15803086	182
	Improper Check for Unusual or Exceptional Conditions SNYK-JS-HANDLEBARS-15807042	169
	Improper Encoding or Escaping of Output SNYK-JS-HANDLEBARS-15807040	166
	Arbitrary Argument Injection SNYK-JS-CONVENTIONALCHANGELOGGITCLIENT-13004533	151
	Prototype Pollution SNYK-JS-HANDLEBARS-15789775	98
	Prototype Pollution SNYK-JS-HANDLEBARS-15813031	78
	Time-of-check Time-of-use (TOCTOU) Race Condition SNYK-JS-HANDLEBARS-15813000	62

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Access of Resource Using Incompatible Type ('Type Confusion')
🦉 Time-of-check Time-of-use (TOCTOU) Race Condition

[lposen]

This major version upgrade from 9.x to 10.x aligns with breaking changes in the core release-it package, requiring potential configuration updates.

Breaking Changes:

• Configuration Migration Required: Version 10 removes configuration options that were deprecated in version 9. Users must migrate from the old configuration structure to the new one. For example, dist.repo configuration has been removed, and options previously under src.* have been moved to git.*. [1]
• Node.js Support: Support for Node.js v6, which reached its end-of-life in April 2019, has been dropped. [1]
• CLI Flag Removal: The --debug flag has been removed in favor of using the DEBUG=release-it:* environment variable. [1]

Recommendation: Before upgrading, review your release-it configuration file (.release-it.json or package.json) to ensure it does not use any of the deprecated options from v9. Update your configuration to the structure introduced in v9 to ensure compatibility with v10.

Source: release-it CHANGELOG

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[qltysh]

⚠️ Comments skipped — @lposen doesn't have a Qlty seat in Iterable.

Qlty doesn't post analysis or coverage comments for contributors without a seat. An authorized user can grant @lposen a seat from this pull request's page in Qlty.

[Copilot]

Pull request overview

This PR updates the repository’s Yarn dependencies to remediate Snyk-reported vulnerabilities by upgrading @release-it/conventional-changelog and refreshing the lockfile resolution.

Changes:

• Bump @release-it/conventional-changelog from ^9.0.4 to ^10.0.2 in package.json.
• Regenerate yarn.lock, updating @release-it/conventional-changelog and its transitive dependency tree.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Upgrades @release-it/conventional-changelog to the requested major version to address vulnerabilities.
yarn.lock	Updates resolved versions and transitive dependencies resulting from the dependency upgrade.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.