build(deps): bump lodash, @release-it/conventional-changelog and release-it

[dependabot]

Removes lodash. It's no longer used after updating ancestor dependencies lodash, @release-it/conventional-changelog and release-it. These dependencies need to be updated together.

Removes lodash

Updates @release-it/conventional-changelog from 8.0.1 to 12.0.2

Release notes

Sourced from @​release-it/conventional-changelog's releases.

Release 12.0.2

• Stage diving is never a good idea (65dda97cf3d94b4a9376c0fce2126c6e0cd83d23)

Release 12.0.1

• Migrate to pnpm (1df408d0b)
• Update dependencies (6d5e4663b)
• Narrow engines.node a bit (e5d723f3a)
• Enable npm staged publishing (39959f474)

Release 12.0.0

• Skip prereleases without a recommended bump (resolve #151) (3451b9d346c27228b02a099a22838216e833a1ba)
• Avoid shell interpolation when staging changelogs (resolve #149) (dbaba1c8eee91fa792986c90c9767a2f6f78e123)
• Use resolved tag as recommended bump boundary (resolve #99) (d7cce4d82cfce4b90998f34b99f624ae7cb7f454)
• Document stable prerelease promotion (resolve #152) (9fa21def00e690ed9c4cfb72ee6ebfe82d291b4d)
• Upgrade dependencies (41b3201f1746605e6cc11bea70ba9ddb2b7e2bb8)

Release 11.0.1

• Restore no-preset fallback to prevent whatBump error (636c254fd1df5c4858d9ab48d1e1c13a1f24412a)
• Bump tmp from 0.2.5 to 0.2.6 (#145) (ce9a599e2762247bc8c71143214ab1cc6c162489) - thanks @​dependabot[bot]!
• Update dependencies (063b6af211b095465490e5b1c801955c7d25e72e)
• Derive tag prefix from resolved tag for recommended bump (resolve #80) (8947320a51403c8eaf47eebad8d3cef637cc3279)
• Document transform override and parseCommits resolution (resolve #78, resolve #137) (f3461f1ed7133bb70022ae4e6dbdd011f6d4641d)
• Run tests on Node 26 (74812985412d061d39352071a0c04666e25c61c5)

Release 11.0.0

• Fix repository.url (23d3d9cd50fdb4475b8736273a776541833862c0)
• docs: fix broken links and remove outdated override warning (#138) (344bad3bf2f90618a86d3e38883a5d5eff12aaf1) - thanks @​aarondpn!
• fix: support release-it 20 (#142) (043242693e5c88244a25fbcf0dceafcbf955588f) - thanks @​twk3!
• Update dependencies & bump engines.node (1b746e6b5a26335cf01c314074dcf7e291c260a0)

Release 10.0.6

• fix: bump conventional-changelog to ^7.2.0 (#141) (0e2bb53395fd5f6037c2244378fdd827d3f0ffd6) - thanks @​aarondpn!
• Update dependencies (1f2572923a00a01276b97c8eece41d38b8f90e02)

Release 10.0.5

• test: add should generate changelog with remote origin urls (#132) (7e53f8ce957b1e2469acfff6bb2d1f9a46654b6f) - thanks @​Maxel01!
• fix: pass parserOpts to both Bumper and ConventionalChangelog (#135) (4dce48ad332aeba00ae49c2f9df229961ab902eb) - thanks @​aarond-sp!

Release 10.0.4

• fix: add readRepository to resolve correct urls (#131) (933bcc6aa5d854158dc3702f004b5cbd4caf4cad) - thanks @​Maxel01!
• Update release-it (ac4426a38d5d2c948884901acf8adec065d54c4f)

Release 10.0.3

• Remove verbose comments (eb178bd556e5939b93a374adc418d6be5cc85323)
• fix: remove preset options filtering (#129) (1b9fb95608117bc3f0f3379188f5c82f3231a792) - thanks @​NateSmyth!

Release 10.0.2

• Remove node 18 from test matrix (e00dabf5cdd374a33361aeda9aa9eaf8cb4be485)
• feat: Preserve preReleaseBase config option (#111) (678faefe7049e30499d19d002c5ef6234a8a77b6) - thanks @​ChAyLom!
• Bump tmp from 0.2.3 to 0.2.4 (#120) (5ccbc29ba2e54308b5ad6fbf5209d50f4268916c) - thanks @​dependabot[bot]!

... (truncated)

Commits

• 7f28a71 Release 12.0.2
• 65dda97 Stage diving is never a good idea
• b0143b8 Release 12.0.1
• 39959f4 Enable npm staged publishing
• e5d723f Narrow engines.node a bit
• 6d5e466 Update dependencies
• 1df408d Migrate to pnpm
• ee8b92e Release 12.0.0
• 41b3201 Upgrade dependencies
• 9fa21de Document stable prerelease promotion (resolve #152)
• Additional commits viewable in compare view

Updates release-it from 17.0.5 to 21.0.3

Release notes

Sourced from release-it's releases.

Release 21.0.3

• Fix npm staging approval URL and prompt (9f64e098aa04aac44fe9484add1f1f2119fa294c)

Release 21.0.2

• Prevent duplicate comments on resolved issues and PRs (#1324) (7ca61cccd16ad56742ee0cb694c946353b66c117) - thanks @​krisu-pl!
• Migrate to pnpm + update deps (6c211f087f465af8942060812ec4ee662419da9f)

Release 21.0.1

• Fix regression and support --no-hooks to skip all hooks (a8888b45b1d9db40a8f8ea5ad625b15b53d78925)

Release 21.0.0

• fix(ci): do not run integration on forks (#1315) (1e90d9f28f08a847029ed58f8ac211028d4203ca) - thanks @​trueberryless!
• Pin GitHub Actions to immutable commits (#1316) (38355d8068ac5c0818bc183ddb39db643aeab0c3)
• Fix npm publish workspace config resolution (#1312) (3bf251f5ab4c3665397aef8a7a4db6a21e02a98f) - thanks @​cyphercodes!
• Add gitlab.repoId option (#1224) (e4e9d0e35cbd99492c8b1a7b48e5a695951af7a2) - thanks @​microHoffman!
• Exit successfully when no release version is available (56c70c3f1436101a9284c535bed233081af85960)
• Support numeric GitLab repository IDs (0332c4ac4ecb8b714c8971b3953c972f59fe1f30)
• Parse CLI arguments strictly (resolve #1196) (caf77c928bfefa48339e8246261ffb8e41d70a4c)
• fix: shell caching and working tree detection (#1317) (8d1f7522ffc6afb445a00ab03357fdc7554b48ac) - thanks @​Mopsgamer!
• Remove dependabot workflow (e7e04ef3fb6151324ffde438a278539fbbc24eec)
• Fix configured GitHub proxy routing (1ed9cddf5d18d2c4107500081254cc7af22eff42)
• Upgrade dependencies and require Node 22 (c055e7fa5b2dcaf5078d4a5c337140a5bea0ac7e)
• Fix npm custom registry argument handling (resolve #1318) (98c45c4503e1d8bad0b7c38d99f6fda380c3681e)
• Pin GitLab releases to the current commit (resolve #1216) (70ab5769852bc5a3fafe4ac193f28bd247fa067e)
• Refresh GitHub Actions and package preview runtime (5c5513966ba2d4f1133c9b33c33850470c12a934)
• Document v21 runtime requirements (daab8460c0f0ed7f8a97c0ef806ef506d59f7268)
• Simplify git-cliff recipe (resolve #1195) (52c89a7965d3aff0a5d2474903fc902dbde59cf5)
• Make GitLab CA tests platform-independent (ba4326fb1a79b700a909ac6adab8bd242401971c)
• Raise Node 22 requirement to 22.21 (df94838844154a6b885af1888af81a75d43c80d9)
• Verify GitLab server certificates by default (c381a2d4ce1deb26a9e54ead63339c4860231bfd)
• Update changelog for v21 (2637e8a91fb560f23686773d3f476bff20daa5ae)

Release 20.2.1

• Document the draft flow for GitHub immutable releases (284e63c6d2022eaf87f9fa66373ca6ad6a942ea0)
• Resolve dependency security alerts (3156203b614039b4e4cf63b1d4addb409606527f)

Release 20.2.0

• Print staged-packages approval URL after stage publish (244d8112498d7283f6bdcfd25d487ecc833aff03)
• Capture the stage id for the approval message (2476065893cfe3421cf54c02d73d280c8192b41d)

Release 20.1.0

• feat: add --quiet flag to hide release previews (#1274) (ecefe4407351bc74a85e88355a2772ea8fb22396) - thanks @​Yeom-JinHo!
• fix: ensure release body is an empty string instead of null (#1303) (5cc5ebd284673cb67b7897c3bd36c3ace6d54880) - thanks @​driiftkiing!
• Add 'Accept-Encoding' header to GitLab API requests (#1301) (14a478e4c1db309a04babe7060f0d95fb2879134) - thanks @​KlausDerKleber!
• Support npm staged publishing (npm.stage) (aa20f56587f0f5720e684d6b1d6b9bc594b3876e)
• Run tests on Node 26 (29f079bf8a515f1fced7bde05902183b1e990b2d)
• Use draft flow for immutable releases with assets (resolve #1295) (c63b4e46710564edf809ea688d12ecc4abc39d33)
• Publish interactively under --only-version so passkey 2FA works (resolve #1234) (4ebb66ebc6cee1b5352aa0fdafc0fa80ad568645)
• Format docs/npm.md (a2a262c524a14b040aa9cc50f3ea45f2e4ac78e3)
• Dogfoodin' (0cb51a9c85cc7e91db57c251e216664197639565)

... (truncated)

Changelog

Sourced from release-it's changelog.

Changelog

This document lists breaking changes for each major release.

See the GitHub Releases page for detailed changelogs: [https://github.com/release-it/release-it/releases][1]

v21 (2026-07-25)

• Removed support for Node.js v20 and raised the Node.js v22 minimum to v22.21.0.
• CLI argument parsing is now strict. Unknown options, invalid booleans, and extra positional arguments are rejected.
• GitLab server certificates are verified by default. Configure private CA or explicitly set gitlab.secure to false.

v20 (2026-03-24)

• Upgraded undici from v6 to v7 to resolve security vulnerabilities.
• Upgraded proxy-agent from v6 to v7 to fix DEP0169 (url.parse() deprecation).
• Migrated from deprecated inquirer to @inquirer/prompts.
• Bumped engines.node to minimum Node.js v20.19.0 (was v20.12.0).

v19 (2025-04-18)

• No breaking changes (dependency party)

v18 (2025-01-06)

• Removed support for Node.js v18.

v17 (2023-11-11)

• Removed support for Node.js v16.

v16 (2023-07-05)

• Removed support for Node.js v14.

v15 (2022-04-30)

• Removed support for Node.js v10 and v12.
• Removed support for GitLab v12.4 and lower.
• Removed anonymous metrics (and the option to disable it).
• Programmatic usage and plugins only through ES Module syntax (import)

Use release-it v14 in legacy environments.

v14 (2020-09-03)

• Removed global property from plugins. Use this.config[key] instead.
• Removed deprecated npm.access option. Set this in package.json instead.

v13 (2020-03-07)

... (truncated)

Commits

• 715e42f Release 21.0.3
• 9f64e09 Fix npm staging approval URL and prompt
• aa8752d Release 21.0.2
• 6c211f0 Migrate to pnpm + update deps
• 7ca61cc Prevent duplicate comments on resolved issues and PRs (#1324)
• 2a1d141 Release 21.0.1
• a8888b4 Fix regression and support --no-hooks to skip all hooks
• 5e9c193 Release 21.0.0
• 2637e8a Update changelog for v21
• c381a2d Verify GitLab server certificates by default
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[kadler]

@dependabot rebase

[dependabot]

Looks like this PR is already up-to-date with master! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[kadler]

These changes were already done in 274c4f1 and unneeded

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.