[CSR-0] chore: Bump yargs from 17.7.3 to 18.1.0 in /packages/jest

[dependabot]

Bumps yargs from 17.7.3 to 18.1.0.

Changelog

Sourced from yargs's changelog.

18.1.0 (2026-07-26)

Features

• ignore bun when getting bin name (b77831c)

Bug Fixes

• lang: 'count' for de locale (#2476) (971e351)
• local prototype pollution vulnerability in apply-extends (437f3a4)
• locale: add Georgian translation (#2474) (086aeaa)

Commits

• 8878a89 chore(main): release 18.1.0 (#2475)
• db916b4 chore: add workflow_dispatch for release-please (#2564)
• 4153e0f chore: improve build robustness (#2554)
• 186d2e6 docs: clarify nargs option-like values (#2551)
• c615633 docs: fix various typos in source code (#2525)
• 7c76d0a docs: fix broken links in api.md (#2549)
• 37e2e5b chore: fix .wrap() docs (#2493)
• 547e300 chore: update the easy dependencies (#2552)
• e086681 chore(deps): update dependency cross-env to v10 (#2480)
• 88f548c chore: fix typos (#2492)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[dependabot]

Assignees

The following users could not be added as assignees: ynahmany. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

[maxigimenez]

Security dependency triage — Tier B, needs a decision. Not auto-mergeable.

What and why. yargs ^17.7.2 → ^18.1.0 in packages/jest. Closes no Vanta finding and no advisory — npm audit --package-lock-only on main (99d37d4) reports only @humanfs/node, @vitest/mocker, vitest and esbuild. Routine major bump, not a security fix.

Exposure. runtime, and it ships. yargs sits in the dependencies block of packages/jest, so it is installed with the published @currents/jest package, not just at development time. Two Tier B criteria apply independently: a major bump anywhere, and a direct dependencies entry of something that ships.

The fix. One file changed: packages/jest/package.json. package-lock.json is not touched, so the lockfile still records packages/jest deps yargs: ^17.7.2 and resolves node_modules/yargs at 17.7.2.

Breaking-change check. yargs 18 is a major of the CLI argument parser — flag parsing and help output are user-visible surface for anyone invoking the reporter's CLI — and it raises the Node floor, which wants checking against engines and the test matrix. That review is owed regardless of the install problem below.

Verification. Reproduced locally against head 4b641ee:

$ npm ci --dry-run
npm error `npm ci` can only install packages when your package.json and
npm error package-lock.json or npm-shrinkwrap.json are in sync.
npm error Missing: yargs@18.1.0 from lock file
npm error Missing: cliui@9.0.1 from lock file
npm error Missing: yargs-parser@22.0.0 from lock file
npm error Missing: string-width@7.2.0 from lock file

Control — the same command on main (99d37d4) completes successfully.

CI coverage. lint.yml, unit-test.yaml and types-matrix.yml all run npm ci; none of the workflows is paths-filtered, so all trigger on this diff. On 4b641ee the checks are red — lint, Unit Tests, jest Types, typecheck-status (run 33400032832). Root-caused above, not a flake.

What a human should still check.

1. Whether @currents/jest should take yargs 18 at all — this is a shipped runtime dependency, so the parser's behaviour change reaches consumers, and [CSR-0] chore: Bump yargs from 17.7.2 to 18.1.0 #413 proposes the same move at the root. Decide the pair together.
2. yargs 18's Node floor against this package's engines and the supported-Node matrix.
3. The lockfile needs regenerating either way; this diff is manifest-only.

Needs release. Yes if it lands — @currents/jest is published, so the yargs major reaches consumers only through a release of that package. Not published from here.

---

Generated by Claude Code