chore(deps-dev): bump @semantic-release/git from 10.0.1 to 11.0.1

[dependabot]

Bumps @semantic-release/git from 10.0.1 to 11.0.1.

Release notes

Sourced from @​semantic-release/git's releases.

v11.0.1

11.0.1 (2026-07-24)

Bug Fixes

• deps: update dependency execa to v10 (#564) (b39d5c6)

v11.0.0

11.0.0 (2026-07-21)

Features

• ES Module (#544) (4d704a2), closes #491 #490

BREAKING CHANGES

• @semantic-release/git is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use @semantic-release/git is now v20.1.0

Other Notable Changes

• @semantic-release/error ^3 → ^4 (ESM-only)
• aggregate-error ^3 → ^5 (ESM-only, uses native AggregateError)
• execa ^5 → ^9 (ESM-only, named export)
• p-reduce ^2 → ^3 (ESM-only)
• Removed CJS-only devDeps: clear-module, file-url, fs-extra, get-stream, nyc
• Added c8 for coverage; bumped ava, sinon, tempy, semantic-release, prettier
• Engine: ^22.22.2 || >= 24.15;
• Scripts: nyc → c8, added pretest, removed test:ci

Related Issue

• semantic-release/semantic-release#2133
• semantic-release/semantic-release#4032

v11.0.0-beta.2

11.0.0-beta.2 (2026-07-20)

Bug Fixes

• update Node.js engine version requirements in package.json and package-lock.json (ddf699e)

... (truncated)

Commits

• b39d5c6 fix(deps): update dependency execa to v10 (#564)
• 9dd61f1 chore(deps): lock file maintenance (#470)
• c5c6f06 chore(deps): update dependency lodash-es to v4.18.1 [security] (#545)
• b67458c ci(action): update actions/setup-node action to v6.5.0 (#557)
• d4990ff ci(action): update actions/checkout action to v6.1.0 (#556)
• 16d191f chore(deps): update dependency tempy to v3.2.0 (#448)
• 8efa7b7 chore(deps): update dependency sinon to v21.1.2 (#554)
• e53dc53 chore(deps): update dependency prettier to v3.9.5 (#552)
• 4c2f87f chore(deps): update dependency ls-engines to v0.10.1 (#551)
• 7685d83 chore(deps): update dependency ava to v6.4.1 (#548)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​semantic-release/git since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

depsound · 1 dependency change · flags to look at now

• npm:@semantic-release/git ^10.0.1 → ^11.0.1: provenance anomaly (account-takeover shape): publisher changed; module format changed: commonjs → module; endpoints resolved from a range at review time: "^11.0.1" reviewed at one satisfying version; a consumer may install another, and a declaration-level change carries no transitive resolution

Checked: the published artifact diff, manifest compatibility, install/build execution surface. Not checked: runtime behaviour, intent (an obfuscated payload reads as ordinary code), whether your code reaches the change, your test coverage.

Continue locally, the full per-file analysis and a grep-able workspace (trees + stats.json) are available for agent investigation:

go run github.com/rvagg/depsound/cmd/depsound@v0.33.0 npm:@semantic-release/git ^10.0.1 ^11.0.1

Or hand this PR to an agent: point it at the PR and the review skill for a proceed/hold call.

_{depsound · full report + logs}