chore: fix transitive dependency vulnerabilities

Update dependencies to resolve security vulnerabilities in transitive deps:

- patch-package: 6.2.2 → 8.0.1
  - Fixes: [email protected] (CVE-2024-4068), [email protected] (CVE-2024-21538)

- conventional-changelog-core: 4.1.4 → 9.0.0
- conventional-changelog-angular: 5.0.6 → 8.1.0
- conventional-changelog-preset-loader: 2.3.0 → 5.0.0
  - Fixes: [email protected] (multiple CVEs), [email protected] (CVE-2021-23362)

- all-contributors-cli: 6.15.0 → 6.26.1
  - Fixes: [email protected] (multiple CVEs)

Co-Authored-By: Claude Opus 4.5 <[email protected]>

Author: Sarah Dayan

package.json

@@ -31,11 +31,11 @@
   },
   "name": "shipjs",
   "devDependencies": {
-    "all-contributors-cli": "6.15.0",
+    "all-contributors-cli": "6.26.1",
     "lerna": "8.2.4"
   },
   "dependencies": {
-    "patch-package": "^6.2.2",
+    "patch-package": "^8.0.1",
     "postinstall-postinstall": "^2.1.0"
   },
   "packageManager": "[email protected]+sha512.ff4579ab459bb25aa7c0ff75b62acebe576f6084b36aa842971cf250a5d8c6cd3bc9420b22ce63c7f93a0857bc6ef29291db39c3e7a23aab5adfd5a4dd6c5d71"

packages/shipjs/package.json

@@ -39,9 +39,9 @@
     "arg": "5.0.2",
     "chalk": "^5.4.1",
     "change-case": "^5.4.4",
-    "conventional-changelog-angular": "^5.0.6",
-    "conventional-changelog-core": "^4.1.4",
-    "conventional-changelog-preset-loader": "^2.3.0",
+    "conventional-changelog-angular": "^8.1.0",
+    "conventional-changelog-core": "^9.0.0",
+    "conventional-changelog-preset-loader": "^5.0.0",
     "deepmerge": "^4.3.1",
     "dotenv": "^16.5.0",
     "ejs": "^3.1.10",

packages/shipjs/src/step/prepare/updateChangelog.js

@@ -3,7 +3,8 @@ import path from 'path';
 
 import addStream from 'add-stream';
 import conventionalChangelogCore from 'conventional-changelog-core';
-import conventionalChangelogPresetLoader from 'conventional-changelog-preset-loader';
+// eslint-disable-next-line import/no-unresolved -- ESM-only package with exports field
+import { loadPreset } from 'conventional-changelog-preset-loader';
 import merge from 'deepmerge';
 import tempfile from 'tempfile';
 
@@ -134,10 +135,7 @@ export async function prepareParams({
     : {};
   if (args.preset) {
     try {
-      args.config = merge(
-        await conventionalChangelogPresetLoader(args.preset),
-        args.config
-      );
+      args.config = merge(await loadPreset(args.preset), args.config);
     } catch (err) {
       /* eslint-disable no-console */
       if (typeof args.preset === 'object') {