Repository navigation
ci: let Dependabot see the release tooling versions - #63
Merged
Merged
Conversation
semantic-release and the conventionalcommits preset were pinned in an `npx -p` line, which Dependabot does not read. They now live in .github/release/package.json with their own Dependabot entry; the preset's majors stay ignored while semantic-release 25 cannot render 10. That manifest has no lockfile on purpose: semantic-release's bundled npm ships glob, minimatch, undici and ip-address versions with advisories, and overrides do not reach bundled packages. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
🎉 This PR is included in version 6.0.0-rc.1 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot does not read the
npx -p semantic-release@… -p conventional-changelog-conventionalcommits@…line inrelease.yml, so the pins never got update PRs.Change
.github/release/package.json, unchanged: semantic-release 25.0.9 and conventional-changelog-conventionalcommits 9.3.1.release.ymlinstalls from there and runs itssemantic-release.dependabot.ymlgets an npm entry for/.github/release, grouped asrelease-tooling. Majors of the conventionalcommits preset are ignored, because semantic-release 25 cannot render 10 (generateNotes fails with "Missing helper").package.jsonhas no lockfile, on purpose. semantic-release bundles npm, whose own glob, minimatch, undici and ip-address versions have advisories.overridescannot reach bundled packages, so a lockfile (or putting the tooling in the rootdevDependencies) would bring back alerts nobody can fix. The install resolves the same way the oldnpx -pline did.Verified: dry run with generateNotes
I made a
file://bare clone of this branch asmasterand ran.github/release/node_modules/.bin/semantic-release --dry-run --no-ci --repository-url file://… --plugins @semantic-release/commit-analyzer,@semantic-release/release-notes-generator. Nothing was pushed to GitHub.fix:commit: the next version is the patch, and the notes render### Bug Fixes.feat!:commit cherry-picked: the next version is 6.0.0, and the notes render### ⚠ BREAKING CHANGESand### Features.Release effect
None (
ci:). Can merge now; independent of the Node 26 PR.🤖 Generated with Claude Code