[CSR-0] chore: Bump release-it from 19.2.4 to 21.0.2 in /packages/jest

[dependabot]

Bumps release-it from 19.2.4 to 21.0.2.

Release notes

Sourced from release-it's releases.

Release 21.0.2

• Prevent duplicate comments on resolved issues and PRs (#1324) (7ca61cccd16ad56742ee0cb694c946353b66c117) - thanks @​krisu-pl!
• Migrate to pnpm + update deps (6c211f087f465af8942060812ec4ee662419da9f)

Release 21.0.1

• Fix regression and support --no-hooks to skip all hooks (a8888b45b1d9db40a8f8ea5ad625b15b53d78925)

Release 21.0.0

• fix(ci): do not run integration on forks (#1315) (1e90d9f28f08a847029ed58f8ac211028d4203ca) - thanks @​trueberryless!
• Pin GitHub Actions to immutable commits (#1316) (38355d8068ac5c0818bc183ddb39db643aeab0c3)
• Fix npm publish workspace config resolution (#1312) (3bf251f5ab4c3665397aef8a7a4db6a21e02a98f) - thanks @​cyphercodes!
• Add gitlab.repoId option (#1224) (e4e9d0e35cbd99492c8b1a7b48e5a695951af7a2) - thanks @​microHoffman!
• Exit successfully when no release version is available (56c70c3f1436101a9284c535bed233081af85960)
• Support numeric GitLab repository IDs (0332c4ac4ecb8b714c8971b3953c972f59fe1f30)
• Parse CLI arguments strictly (resolve #1196) (caf77c928bfefa48339e8246261ffb8e41d70a4c)
• fix: shell caching and working tree detection (#1317) (8d1f7522ffc6afb445a00ab03357fdc7554b48ac) - thanks @​Mopsgamer!
• Remove dependabot workflow (e7e04ef3fb6151324ffde438a278539fbbc24eec)
• Fix configured GitHub proxy routing (1ed9cddf5d18d2c4107500081254cc7af22eff42)
• Upgrade dependencies and require Node 22 (c055e7fa5b2dcaf5078d4a5c337140a5bea0ac7e)
• Fix npm custom registry argument handling (resolve #1318) (98c45c4503e1d8bad0b7c38d99f6fda380c3681e)
• Pin GitLab releases to the current commit (resolve #1216) (70ab5769852bc5a3fafe4ac193f28bd247fa067e)
• Refresh GitHub Actions and package preview runtime (5c5513966ba2d4f1133c9b33c33850470c12a934)
• Document v21 runtime requirements (daab8460c0f0ed7f8a97c0ef806ef506d59f7268)
• Simplify git-cliff recipe (resolve #1195) (52c89a7965d3aff0a5d2474903fc902dbde59cf5)
• Make GitLab CA tests platform-independent (ba4326fb1a79b700a909ac6adab8bd242401971c)
• Raise Node 22 requirement to 22.21 (df94838844154a6b885af1888af81a75d43c80d9)
• Verify GitLab server certificates by default (c381a2d4ce1deb26a9e54ead63339c4860231bfd)
• Update changelog for v21 (2637e8a91fb560f23686773d3f476bff20daa5ae)

Release 20.2.1

• Document the draft flow for GitHub immutable releases (284e63c6d2022eaf87f9fa66373ca6ad6a942ea0)
• Resolve dependency security alerts (3156203b614039b4e4cf63b1d4addb409606527f)

Release 20.2.0

• Print staged-packages approval URL after stage publish (244d8112498d7283f6bdcfd25d487ecc833aff03)
• Capture the stage id for the approval message (2476065893cfe3421cf54c02d73d280c8192b41d)

Release 20.1.0

• feat: add --quiet flag to hide release previews (#1274) (ecefe4407351bc74a85e88355a2772ea8fb22396) - thanks @​Yeom-JinHo!
• fix: ensure release body is an empty string instead of null (#1303) (5cc5ebd284673cb67b7897c3bd36c3ace6d54880) - thanks @​driiftkiing!
• Add 'Accept-Encoding' header to GitLab API requests (#1301) (14a478e4c1db309a04babe7060f0d95fb2879134) - thanks @​KlausDerKleber!
• Support npm staged publishing (npm.stage) (aa20f56587f0f5720e684d6b1d6b9bc594b3876e)
• Run tests on Node 26 (29f079bf8a515f1fced7bde05902183b1e990b2d)
• Use draft flow for immutable releases with assets (resolve #1295) (c63b4e46710564edf809ea688d12ecc4abc39d33)
• Publish interactively under --only-version so passkey 2FA works (resolve #1234) (4ebb66ebc6cee1b5352aa0fdafc0fa80ad568645)
• Format docs/npm.md (a2a262c524a14b040aa9cc50f3ea45f2e4ac78e3)
• Dogfoodin' (0cb51a9c85cc7e91db57c251e216664197639565)

Release 20.0.1

• fix: allow false as npm config value in types (#1289) (f783e825944cf8114305606116ca61542f0031c6) - thanks @​ahippler!

... (truncated)

Changelog

Sourced from release-it's changelog.

Changelog

This document lists breaking changes for each major release.

See the GitHub Releases page for detailed changelogs: [https://github.com/release-it/release-it/releases][1]

v21 (2026-07-25)

• Removed support for Node.js v20 and raised the Node.js v22 minimum to v22.21.0.
• CLI argument parsing is now strict. Unknown options, invalid booleans, and extra positional arguments are rejected.
• GitLab server certificates are verified by default. Configure private CA or explicitly set gitlab.secure to false.

v20 (2026-03-24)

• Upgraded undici from v6 to v7 to resolve security vulnerabilities.
• Upgraded proxy-agent from v6 to v7 to fix DEP0169 (url.parse() deprecation).
• Migrated from deprecated inquirer to @inquirer/prompts.
• Bumped engines.node to minimum Node.js v20.19.0 (was v20.12.0).

v19 (2025-04-18)

• No breaking changes (dependency party)

v18 (2025-01-06)

• Removed support for Node.js v18.

v17 (2023-11-11)

• Removed support for Node.js v16.

v16 (2023-07-05)

• Removed support for Node.js v14.

v15 (2022-04-30)

• Removed support for Node.js v10 and v12.
• Removed support for GitLab v12.4 and lower.
• Removed anonymous metrics (and the option to disable it).
• Programmatic usage and plugins only through ES Module syntax (import)

Use release-it v14 in legacy environments.

v14 (2020-09-03)

• Removed global property from plugins. Use this.config[key] instead.
• Removed deprecated npm.access option. Set this in package.json instead.

v13 (2020-03-07)

... (truncated)

Commits

• aa8752d Release 21.0.2
• 6c211f0 Migrate to pnpm + update deps
• 7ca61cc Prevent duplicate comments on resolved issues and PRs (#1324)
• 2a1d141 Release 21.0.1
• a8888b4 Fix regression and support --no-hooks to skip all hooks
• 5e9c193 Release 21.0.0
• 2637e8a Update changelog for v21
• c381a2d Verify GitLab server certificates by default
• df94838 Raise Node 22 requirement to 22.21
• ba4326f Make GitLab CA tests platform-independent
• Additional commits viewable in compare view

[dependabot]

Assignees

The following users could not be added as assignees: ynahmany. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

[maxigimenez]

Security triage: Tier C — do not merge, recommend closing unmerged

Superseded by #398, and independently unmergeable as it stands.

Superseded. #398 (release-it 19.2.4 → 21.0.2 at the root) makes the same packages/jest/package.json edit this PR makes — "release-it": "^19.2.4" → "^21.0.2" — and also edits packages/cmd/package.json, packages/node-test-reporter/package.json, and package-lock.json. Verified by reading both file lists, not the titles. This PR is a strict subset of #398 with nothing of its own.

Unmergeable on its own. The diff is one file, packages/jest/package.json, with no package-lock.json change. Every workflow in this repo installs with npm ci (lint.yml, unit-test.yaml, types-matrix.yml, publish.yaml), and npm ci refuses a manifest/lockfile mismatch rather than resolving it. CI on head b5df02d confirms it:

check	conclusion
lint	failure
Unit Tests	failure
jest Types	failure
typecheck-status	failure
matrix	success
[code]smith	skipped

Four of the five real jobs fail, and the one that passes (matrix) only computes the workspace list and installs nothing. Merging this would put main in a state where npm ci fails.

No security cost to closing. The advisories behind the release-it bump — high release-it 18.0.0-next.0 - 19.2.4, high undici <=6.27.0 (12 advisories), high basic-ftp <=5.3.0 — are all closed by #398, which is green. Nothing is lost by closing this. None of them has a Vanta finding, so no SLA clock is affected either way.

What a human should still check. Nothing about this PR. Close it and review #398 instead — full evidence is in the triage comment there.

Labelled do not merge. Not closed — this is not my PR to close.

---

Generated by Claude Code