Skip to content

Update metcalfc/changelog-generator action to v4.8.0 - #45

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/metcalfc-changelog-generator-4.x
Open

Update metcalfc/changelog-generator action to v4.8.0#45
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/metcalfc-changelog-generator-4.x

Conversation

@renovate

@renovate renovate Bot commented Mar 25, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
metcalfc/changelog-generator action minor v4.6.2v4.8.0

Release Notes

metcalfc/changelog-generator (metcalfc/changelog-generator)

v4.8.0

Compare Source

Highlights

Failed changelog generation now fails the step

If the changelog could not be generated — an unresolvable ref, any git error — the action printed an ::error:: annotation and then exited 0. The step went green, outputs.changelog was never set, and downstream steps consumed an empty string without anything indicating a problem.

It now exits non-zero.

[!WARNING]
This is a behavior change. A workflow that was quietly passing on a broken changelog will now fail. That is the point — but expect it to surface as new red builds rather than as new errors, since the errors were always being printed.

fetch: true no longer intermittently fails on shallow checkouts

The default fetch path chained two git fetch --depth=1 calls ahead of git fetch --unshallow. Each rewrites .git/shallow while the next has already read it, so git would intermittently abort with:

fatal: shallow file has changed since we read it

Because fetch: true is the default and the exit code was being discarded, this produced a silently empty changelog rather than a visible failure. It was happening in this repository's own CI.

Now a single fetch, requesting --unshallow only when the checkout is actually shallow.

Testing

make test previously ran npm test || echo "no tests available", where npm test was exit 1 — it reported success unconditionally. The project now has a real suite covering changelog.sh against live git fixtures, ref validation, the release scripts, and the built dist/ bundle as the runner executes it. Both fixes above were found by adding it.

Full changelog

  • 98b1282 - 4.8.0
  • 32f61b2 - fix: make the version bump scripts portable (#​466)
  • f64bf35 - build(deps-dev): bump eslint from 10.1.0 to 10.8.1 (#​460)
  • e5f3244 - build(deps-dev): bump brace-expansion from 5.0.5 to 5.0.7 (#​448)
  • 57d0aa3 - build(deps-dev): bump globals from 17.4.0 to 17.9.0 (#​457)
  • ce20209 - build(deps-dev): bump prettier from 3.8.1 to 3.9.6 (#​454)
  • 89d0cce - build(deps): bump actions/attest-build-provenance from 4.1.0 to 4.2.2 (#​464)
  • daae4ab - build(deps): bump the codeql-action group with 3 updates (#​461)
  • 58f7ad5 - fix: fail the step when the changelog cannot be generated (#​465)
  • 4ffdab6 - build(deps-dev): bump @​vercel/ncc from 0.38.4 to 0.44.1 (#​441)
  • ce7d426 - ci: bump codeql-action to v4.37.1 and group its future updates (#​459)
  • cbc6a25 - test: replace the no-op test target with a real suite (#​458)
  • f278f3b - docs: update README example to use actions/checkout v6
  • 3f3af1f - fix: bump actions to Node 24-compatible versions
  • 10c0451 - fix: pin codeql-action to SHA and document supply chain security

v4.7.0

Compare Source

  • 0440d09 - 4.7.0
  • b86feab - fix: drop abandoned replace package, use sed instead
  • 045501a - fix: add build provenance attestation to release workflow
  • 2be9bc1 - feat: upgrade to node24, bump deps, and fix remaining vulnerabilities
  • 250ea21 - fix: override undici to >=6.23.0 to resolve resource exhaustion vulnerability
  • 17d8ad0 - fix: override minimatch to >=3.1.3 to resolve ReDoS vulnerability
  • aab575c - build(deps): bump actions/stale from 10.1.0 to 10.2.0
  • 9e6e620 - Bump @​eslint/js from 9.39.1 to 10.0.1 (#​388)
  • 588e748 - Bump eslint from 9.39.1 to 10.0.0 (#​389)
  • dfc08c5 - Bump isexe from 3.1.1 to 4.0.0 (#​391)
  • 686de53 - Bump globals from 17.0.0 to 17.3.0 (#​386)
  • 364c6d6 - Bump prettier from 3.7.3 to 3.8.1 (#​376)
  • 0ff00c4 - Bump actions/checkout from 6.0.0 to 6.0.2 (#​377)
  • 3e69b75 - Bump @​actions/github from 7.0.0 to 9.0.0 (#​385)
  • 39f8612 - Bump @​actions/exec from 2.0.0 to 3.0.0 (#​384)
  • d347780 - Bump @​actions/core from 2.0.2 to 3.0.0 (#​383)
  • b592e8d - Merge pull request #​367 from metcalfc/dependabot/npm_and_yarn/actions/exec-2.0.0
  • 13741ca - Bump @​actions/exec from 1.1.1 to 2.0.0
  • 0845166 - Merge pull request #​373 from metcalfc/dependabot/npm_and_yarn/actions/core-2.0.2
  • c74c8e7 - Bump @​actions/core from 2.0.1 to 2.0.2
  • 2d92ae4 - Merge pull request #​372 from metcalfc/dependabot/npm_and_yarn/globals-17.0.0
  • a9e4c3f - Bump globals from 16.5.0 to 17.0.0
  • 033e372 - Merge pull request #​374 from metcalfc/dependabot/npm_and_yarn/actions/github-7.0.0
  • b6aca99 - Bump @​actions/github from 6.0.1 to 7.0.0
  • 7ce1518 - Merge pull request #​368 from metcalfc/dependabot/npm_and_yarn/actions/core-2.0.1
  • 89e58fd - Bump @​actions/core from 1.11.1 to 2.0.1
  • e5a31a2 - Merge pull request #​362 from metcalfc/dependabot/npm_and_yarn/prettier-3.7.3
  • 585c493 - Merge pull request #​357 from metcalfc/dependabot/npm_and_yarn/js-yaml-4.1.1
  • 76c95d4 - Merge pull request #​359 from metcalfc/dependabot/github_actions/actions/checkout-6.0.0
  • 5d2cf68 - Bump prettier from 3.6.1 to 3.7.3
  • 17cd2df - Bump actions/checkout from 5.0.0 to 6.0.0
  • 6d41509 - Bump js-yaml from 4.1.0 to 4.1.1
  • 2003f41 - Merge pull request #​355 from metcalfc/dependabot/npm_and_yarn/eslint-9.39.1
  • 40a9ac2 - Bump eslint from 9.39.0 to 9.39.1
  • e4f374d - Merge pull request #​352 from metcalfc/dependabot/npm_and_yarn/globals-16.5.0
  • 191bf39 - Merge pull request #​353 from metcalfc/dependabot/npm_and_yarn/eslint/js-9.39.0
  • 34e79d8 - Merge pull request #​351 from metcalfc/dependabot/npm_and_yarn/eslint-9.39.0
  • 62bd44b - Bump @​eslint/js from 9.38.0 to 9.39.0
  • e522eba - Bump globals from 16.4.0 to 16.5.0
  • a3bac20 - Bump eslint from 9.38.0 to 9.39.0
  • 8cd6286 - Merge pull request #​350 from metcalfc/dependabot/npm_and_yarn/eslint-9.38.0
  • ad21991 - Bump eslint from 9.37.0 to 9.38.0
  • 0afbc99 - Merge pull request #​348 from metcalfc/fix/codeql-permissions
  • 1c146da - fix: add security-events write permission to CodeQL workflow
  • ee94deb - Merge pull request #​347 from metcalfc/fix/codeql-push-trigger
  • 09b9c07 - fix: add push trigger to CodeQL workflow for default branch scanning
  • 5114e96 - Merge pull request #​346 from metcalfc/alert-autofix-9
  • c33398f - Merge pull request #​345 from metcalfc/alert-autofix-7
  • 0d2907a - Potential fix for code scanning alert no. 9: Workflow does not contain permissions
  • 41210ab - Merge pull request #​342 from metcalfc/alert-autofix-6
  • 99e8d80 - Merge pull request #​343 from metcalfc/alert-autofix-5
  • 1a73473 - Merge pull request #​344 from metcalfc/alert-autofix-2
  • b89e945 - Potential fix for code scanning alert no. 2: Workflow does not contain permissions
  • e064bc9 - fix: Permissions for the CodeQL Action.
  • d06c29c - Potential fix for code scanning alert no. 5: Workflow does not contain permissions
  • 21534fd - Potential fix for code scanning alert no. 6: Workflow does not contain permissions
  • 3ba6629 - Merge pull request #​340 from metcalfc/dependabot/npm_and_yarn/eslint-9.37.0
  • cdf755a - Merge pull request #​339 from metcalfc/dependabot/npm_and_yarn/eslint/js-9.37.0
  • 09ec90f - Bump eslint from 9.34.0 to 9.37.0
  • 1873f11 - Bump @​eslint/js from 9.34.0 to 9.37.0
  • 6227b68 - Merge pull request #​334 from metcalfc/dependabot/npm_and_yarn/globals-16.4.0
  • cb41dc8 - Merge pull request #​335 from metcalfc/dependabot/npm_and_yarn/vercel/ncc-0.38.4
  • 3de1395 - Merge pull request #​338 from metcalfc/dependabot/github_actions/actions/stale-10.1.0
  • faba866 - Merge pull request #​341 from metcalfc/dependabot/github_actions/github/codeql-action-4
  • a4da1ae - Bump github/codeql-action from 3 to 4
  • a15082a - Bump actions/stale from 10.0.0 to 10.1.0
  • c780335 - Bump @​vercel/ncc from 0.38.3 to 0.38.4
  • 4e874d3 - Bump globals from 16.3.0 to 16.4.0
  • 14a9ad6 - Merge pull request #​331 from metcalfc/dependabot/github_actions/actions/stale-10.0.0
  • 4451077 - Merge pull request #​330 from metcalfc/dependabot/github_actions/ncipollo/release-action-1.20.0
  • 59f23cd - Merge pull request #​328 from metcalfc/dependabot/npm_and_yarn/eslint/js-9.34.0
  • 4af4b02 - Merge pull request #​327 from metcalfc/dependabot/npm_and_yarn/eslint-9.34.0
  • 3cd0940 - Bump actions/stale from 9.1.0 to 10.0.0
  • 33490a3 - Bump ncipollo/release-action from 1.16.0 to 1.20.0
  • 48dcdf2 - Bump @​eslint/js from 9.33.0 to 9.34.0
  • 02bd226 - Bump eslint from 9.33.0 to 9.34.0
  • e9181f4 - Merge pull request #​326 from metcalfc/dependabot/github_actions/actions/checkout-5.0.0
  • affa499 - Merge pull request #​325 from metcalfc/dependabot/npm_and_yarn/eslint-9.33.0
  • 258c462 - Bump eslint from 9.29.0 to 9.33.0
  • b4db5bf - Merge pull request #​324 from metcalfc/dependabot/npm_and_yarn/eslint/js-9.33.0
  • ca50674 - Bump @​eslint/js from 9.29.0 to 9.33.0
  • 6c72b2e - Merge pull request #​317 from metcalfc/dependabot/npm_and_yarn/globals-16.3.0
  • 8aa7d43 - Bump actions/checkout from 4.2.2 to 5.0.0
  • dd746e6 - Bump globals from 16.2.0 to 16.3.0
  • 179e4c6 - Merge pull request #​312 from metcalfc/dependabot/npm_and_yarn/prettier-3.6.1
  • 5f3246d - Merge pull request #​310 from metcalfc/dependabot/npm_and_yarn/eslint-9.29.0
  • 57be2a5 - Merge pull request #​309 from metcalfc/dependabot/npm_and_yarn/eslint/js-9.29.0
  • 0618660 - Merge pull request #​306 from metcalfc/dependabot/npm_and_yarn/globals-16.2.0
  • 5e28905 - Bump prettier from 3.5.3 to 3.6.1
  • 3a15393 - Bump eslint from 9.25.0 to 9.29.0
  • 9a02e6f - Bump @​eslint/js from 9.25.0 to 9.29.0
  • f6fd2b4 - Bump globals from 16.1.0 to 16.2.0
  • ea5b63f - Merge pull request #​303 from metcalfc/dependabot/npm_and_yarn/undici-5.29.0
  • 9db953a - Bump undici from 5.28.5 to 5.29.0
  • 52ebf7e - Merge pull request #​301 from metcalfc/dependabot/npm_and_yarn/globals-16.1.0
  • e583edc - Merge pull request #​302 from metcalfc/dependabot/npm_and_yarn/actions/github-6.0.1
  • c4e70a6 - Bump @​actions/github from 6.0.0 to 6.0.1
  • 201fdef - Bump globals from 16.0.0 to 16.1.0
  • 74195ce - Merge pull request #​295 from metcalfc/dependabot/npm_and_yarn/eslint-9.25.0
  • af4525a - Bump eslint from 9.24.0 to 9.25.0
  • a85d3e2 - Merge pull request #​294 from metcalfc/dependabot/npm_and_yarn/eslint-9.24.0
  • 7c6abbd - Merge pull request #​293 from metcalfc/dependabot/npm_and_yarn/eslint/js-9.24.0
  • 4f6de05 - Merge pull request #​292 from metcalfc/dependabot/github_actions/metcalfc/changelog-generator-4.6.2
  • ea5463d - Bump eslint from 9.23.0 to 9.24.0
  • 0da0f22 - Bump @​eslint/js from 9.23.0 to 9.24.0
  • 7bfc06a - Bump metcalfc/changelog-generator from 4.5.0 to 4.6.2

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/metcalfc-changelog-generator-4.x branch from 93db862 to 3fcfcea Compare August 11, 2026 00:49
@renovate renovate Bot changed the title Update metcalfc/changelog-generator action to v4.7.0 Update metcalfc/changelog-generator action to v4.8.0 Aug 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants