[CSR-0] chore: Bump yargs from 17.7.2 to 18.1.0

[dependabot]

Bumps yargs from 17.7.2 to 18.1.0.

Changelog

Sourced from yargs's changelog.

18.1.0 (2026-07-26)

Features

• ignore bun when getting bin name (b77831c)

Bug Fixes

• lang: 'count' for de locale (#2476) (971e351)
• local prototype pollution vulnerability in apply-extends (437f3a4)
• locale: add Georgian translation (#2474) (086aeaa)

17.7.3 (2026-06-19)

Bug Fixes

• fix: use entry point with file extension for anything that supports exports (#2514) (c7597e3)

16.2.2 (2026-06-19)

Bug Fixes

• fix: use entry point with .cjs file extension for yargs export (#2546) (6feb819)

18.0.0 (2025-05-26)

⚠ BREAKING CHANGES

• command names are not derived from modules passed to command.
• singleton usage of yargs yargs.foo, yargs().argv, has been removed.
• minimum node.js versions now ^20.19.0 || ^22.12.0 || >=23.
• yargs is now ESM first

Features

• commandDir now works with ESM files (#2461) (27eec18)
• locale: adds hebrew translation (#2357) (4266485)
• yargs is now ESM first (d90af45)
• zsh: Add default completion as fallback (#2331) (e02c91b)

Bug Fixes

• addDirectory do not support absolute command dir (#2465) (3a40a78)
• allows ESM modules commands to be extensible using visit option (#2468) (200e1aa)
• browser: fix shims so that yargs continues working in browser context (#2457) (4ae5f57)
• build: address problems with typescript compilation (#2445) (8d72fb3)

... (truncated)

Commits

• 8878a89 chore(main): release 18.1.0 (#2475)
• db916b4 chore: add workflow_dispatch for release-please (#2564)
• 4153e0f chore: improve build robustness (#2554)
• 186d2e6 docs: clarify nargs option-like values (#2551)
• c615633 docs: fix various typos in source code (#2525)
• 7c76d0a docs: fix broken links in api.md (#2549)
• 37e2e5b chore: fix .wrap() docs (#2493)
• 547e300 chore: update the easy dependencies (#2552)
• e086681 chore(deps): update dependency cross-env to v10 (#2480)
• 88f548c chore: fix typos (#2492)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by shadowspawn, a new releaser for yargs since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[dependabot]

Assignees

The following users could not be added as assignees: ynahmany. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

[maxigimenez]

Security triage: Tier B — needs a decision. Major bump.

What and why — yargs 17.7.2 → 18.1.0. This closes no security finding. npm audit on this repo reports @humanfs/node (moderate, <0.16.8), vitest / @vitest/mocker (moderate, ≤4.1.10) and esbuild (low, 0.27.3–0.28.0); yargs is not among them. There is no Vanta finding for this repo due inside the next 30 days, so this is not on a compliance clock.

Exposure — yargs parses the command line for the published CLI packages, so its behaviour is user-visible surface: flag parsing, coercion and help output are the product here, not an implementation detail.

Why Tier B — a major bump is Tier B under this rubric and is never taken to close an alert. yargs 18 also raises its minimum Node version relative to the 17 line, which has to be checked against this repo's declared engines and against the Node versions the test matrix covers before it can land.

Breaking-change check — I did not read the yargs 18 migration notes closely enough to clear them, and I am not going to imply otherwise. That reading is the substance of this review, and it belongs with whoever takes the bump.

CI coverage — lint, types-matrix and unit-test all run on every PR to main with no paths filter, so a green run here would be real evidence — but it would only cover the paths the suite exercises, not every flag the CLI accepts.

Verification — I read the diff summary and the dependency scope. I did not run this repo's scripts against this branch.

What a human should still check — the yargs 17 → 18 changelog against the CLI's actual flag surface, and the Node floor against engines and the test matrix. #418 moves the same dependency in packages/jest; these two want to land together or not at all.

---

Generated by Claude Code