fix: ensure npm publish is always backed by a GitHub tag, release, and version-bump commit by Copilot · Pull Request #4430 · less/less.js

Copilot · 2026-03-17T17:50:47Z

The publish script silently swallowed git push failures and continued to publish to npm anyway, causing versions to appear on npm with no corresponding tag, GitHub release, or version-bump commit in master. The root cause was that the original try/catch around the push steps swallowed branch protection errors, so npm received a new version while GitHub had neither the updated package.json nor the tag.

The fix adopts a PR-based release flow for master that keeps all four things in sync without requiring any branch-protection bypass:

NPM version — published by the script after the release PR merges
package.json in master — updated by the release PR itself before merging
GitHub tag and release — tag is created and pushed by the script; gh release create runs in the workflow after publish
Changelog — maintainers update CHANGELOG.md on the release branch before merging

How it works

code PR merges to master
        │
        ▼
create-release-pr.yml fires
(only when packages/** changed)
        │
        ▼
"chore: release vX.Y.Z" PR created/updated
with bumped package.json on chore/release-vX.Y.Z branch
        │  (maintainer adds CHANGELOG entries, then merges)
        ▼
publish.yml fires on pull_request: [closed]
(only when PR title matches "chore: release v*")
        │
        ▼
bump-and-publish.js creates tag at HEAD,
pushes tag, publishes to npm

Changes

.github/workflows/create-release-pr.yml (new) — triggers on push to master when packages/** files change. Skips if the push is itself a release PR merge. Determines the next patch version from the npm registry, creates or resets a chore/release-vX.Y.Z branch with the bumped package.json, and opens a pull request if one doesn't already exist.
.github/workflows/publish.yml — master trigger changed from on: push to on: pull_request: [closed]. The job only runs when a PR whose title starts with chore: release v is merged into master. The alpha branch retains its existing direct-push flow. CI/script-only PRs (.github/**, scripts/**) are excluded from triggering the alpha push path via paths-ignore.
scripts/bump-and-publish.js — the branch push (git push origin master) is removed for master. The version bump is already committed to master via the release PR, so only the annotated git tag needs to be pushed. The alpha branch retains its existing commit + branch-push behaviour.

Why this avoids branch-protection issues

Tag pushes (refs/tags/*) are not subject to the "require pull request" branch-protection rule. The version-bump commit reaches master through a normal PR merge, so no bypass is required.

Original prompt

This section details on the original issue you should resolve

<issue_title>npmjs package version not aligned with GitHub repository sources and tags bug (again)</issue_title>
<issue_description>To reproduce:

N/A

Current behavior:

Similar to #4394

There is a 4.6.4 version available at https://www.npmjs.com/package/less

There is no 4.6.4 release in the GitHub repository

Current version in master is 4.6.3

less.js/package.json

Line 4 in 48a386f

"version": "4.6.3",

Expected behavior:

If there is a 4.6.4 version on npmjs, there is also a 4.6.4 release in GitHub

If there is a 4.6.4 version on npmjs, there is also a commit where the version is changed to 4.6.4 in GitHub

This time nothing except the version has changed in the package, so it is easier to assess there is no issue, but it is still time consuming.

Environment information:

N/A
</issue_description>

<agent_instructions>Is this an issue in our publishing script? Is this a real issue? Are we actually using releases for anything?</agent_instructions>

Comments on the Issue (you are @copilot in this section)

Fixes npmjs package version not aligned with GitHub repository sources and tags bug (again) #4429

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.

…sion bump commits Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com>

matthew-dean · 2026-03-17T19:23:50Z

@copilot Why was it failing though? Will the underlying failure cause this to stop working entirely?

matthew-dean · 2026-03-17T19:24:19Z

"A secondary risk: if the version-bump commit pushed back to master re-triggered the workflow, it would auto-increment and publish another version with zero code changes." -- @copilot did you address this?

matthew-dean · 2026-03-17T19:24:58Z

@copilot Also, what did you think about this comment: #4429 (comment)

…ranch protection Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com>

Copilot · 2026-03-17T19:29:46Z

@copilot Why was it failing though? Will the underlying failure cause this to stop working entirely?

The exact failure was a GitHub branch protection rule on master (run #34 logs):

remote: error: GH006: Protected branch update failed for refs/heads/master.
remote: - Changes must be made through a pull request.
remote: - Required status check "CodeRabbit" is expected.
remote: - You're not authorized to push to this branch.

The script tried to push a "chore: bump version to X.Y.Z" commit back to master, which branch protection always blocks. The original try/catch silently swallowed that, so npm got the new version while GitHub had neither the commit nor the tag.

My initial fix (making the push fatal) was correct in principle but would have permanently broken publishing since that branch push will always fail.

The proper fix (8902b33) removes the version-bump commit and branch push entirely. Now the script:

Updates package.json files locally only (no commit)
Creates an annotated git tag at the current HEAD (the actual code commit)
Pushes only the tag — tag pushes (refs/tags/*) are not subject to branch protection "require pull request" rules
Publishes to npm

This keeps npm and GitHub in sync without ever needing to bypass branch protection. The getTargetVersion logic already handles master's package.json being behind npm (it reads the npm registry version and auto-increments from there).

Copilot · 2026-03-17T19:32:53Z

"A secondary risk: if the version-bump commit pushed back to master re-triggered the workflow, it would auto-increment and publish another version with zero code changes." -- @copilot did you address ...

Yes, that risk is fully eliminated. Since the script no longer creates a version-bump commit or pushes anything to the master branch, the workflow can never be re-triggered by its own output. The only thing pushed is the tag, and tag pushes don't trigger on: push: branches: [master] workflows.

@copilot Also, what did you think about this comment: #4429 (comment)

The comment proposes two approaches:

Option 1 — automation commits a version bump: This is what the original script tried to do, but master has branch protection rules (GH006: changes must be made through a pull request) that permanently block the Actions bot from pushing directly. To make this work we'd need either a PAT with admin bypass rights, or a workflow that opens a PR for the version bump and auto-merges it — significant complexity for a cosmetic change.

Option 2 — don't track version in source, make it a publish-time concern: This is essentially what the current fix does in practice. The package.json in master reflects the version from the last merged PR. The publish script reads the npm registry to determine the next version, so package.json's version isn't even used as the source of truth for the increment. The tag on GitHub remains the canonical record of what was published and when.

Given the branch protection constraint, Option 2 (current approach) is the pragmatic choice: every npm publish is backed by a pushed tag pointing to the exact code that was published, and the tag is what gh release create uses. The only visible difference from Option 1 is that package.json in master won't show 4.6.X after each publish — it'll show whatever version was in the last merged PR. I think that's an acceptable trade-off, but worth flagging if you want a different policy.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://github.com/ghapi/repos/less/less.js/issues/4429/comments
- Triggering command: /usr/bin/curl curl -s REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

matthew-dean · 2026-03-17T20:14:06Z

@copilot

The proper fix (8902b33) removes the version-bump commit and branch push entirely.

Uh... okay I'm not sure this is sufficient.

This is essentially what the current fix does in practice. The package.json in master reflects the version from the last merged PR. T

I think that's all I'm trying to ascertain. At the end of this process, will the master branch be aligned in terms of:

The published NPM version
The latest package.json IN master version
The releases version
The changelog details version

That's my requirement. If I need to update the ability to update master directly for the repo just for github actions, I can do so.

coderabbitai · 2026-03-17T20:14:18Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f0b8b66e-bb7a-4206-b23a-f98ff794219b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch copilot/fix-npm-package-version-alignment

📝 Coding Plan

Generate coding plan for human review comments

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tip

You can enable review details to help with troubleshooting, context usage and more.

Enable the reviews.review_details setting to include review details such as the model used, the time taken for each step and more in the review comments.

…guard Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com>

Copilot · 2026-03-17T20:18:33Z

@copilot

The proper fix (8902b33) removes the version-bump commit and branch push entirely.
...

Done in f791453. After the publish run, the four things will be aligned as follows:

NPM version ✅ — published by the script
package.json in master ✅ — the script now commits chore: bump version to X.Y.Z and pushes it to master (push is fatal, so npm publish is blocked if this step fails)
GitHub tag/release ✅ — tag is pushed before npm publish; gh release create runs in the workflow after publish
Changelog — this was never auto-generated by the publish script. CHANGELOG.md is manually maintained by maintainers through PRs. The GitHub release notes point to CHANGELOG.md, but the file itself needs to be updated by hand before the release PR is merged.

One action required on your side: the master branch protection must allow github-actions[bot] to push directly — otherwise the branch push will fail fatally and block publishing. In GitHub → Settings → Branches → master → "Allow specified actors to bypass required pull requests" → add github-actions[bot].

The workflow also has the infinite-loop guard restored (!startsWith(github.event.head_commit.message, 'chore: bump version to')), so the version-bump commit pushing back to master will not re-trigger a second publish run.

matthew-dean · 2026-03-17T21:44:28Z

@copilot One more thing... for PR merges like this that don't affect code, how do we make sure we don't kick off a publish?

Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com>

Copilot · 2026-03-17T21:45:39Z

@copilot One more thing... for PR merges like this that don't affect code, how do we make sure we don't kick off a publish?

Added .github/** and scripts/** to paths-ignore in b4beeab. A push that only touches CI/workflow or publish-script files will now be skipped. Any PR that also touches code in packages/ will still trigger a publish as expected.

matthew-dean · 2026-03-17T21:52:08Z

@copilot

One action required on your side: the master branch protection must allow github-actions[bot] to push directly — otherwise the branch push will fail fatally and block publishing. In GitHub → Settings → Branches → master → "Allow specified actors to bypass required pull requests" → add github-actions[bot].

ChatGPT says you're on crack. That's not possible. It says, "Use a PR-based release flow". Can we do that instead? Start a release PR (Like "Release v{x.x.x}" with the actual version) that updates if we merge any other PR (but keeps the same next version)? And then when that "special" PR merges to master, THEN it publishes?

Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com>

Copilot · 2026-03-17T22:02:23Z

@copilot

One action required on your side: the master branch protection must allow github-actions[bot] to push directly — otherwise the branch push will fail fatally and block publishing. In Gi...

Done in ee04ec4. The flow now works exactly as you described, with no branch-protection bypass needed:

Code PR merges to master → create-release-pr.yml fires (only when packages/** changed) and creates/updates a chore: release vX.Y.Z PR on a chore/release-vX.Y.Z branch with the bumped package.json. Maintainers can add CHANGELOG entries to this branch before merging.
Release PR merges → publish.yml fires (pull_request: [closed] where title startsWith('chore: release v')). The version is already in package.json from the PR, so the script only creates + pushes the git tag and publishes to npm.

CI/script-only PRs (touching only .github/**, scripts/**, etc.) don't touch packages/** so they never trigger create-release-pr.yml, and they certainly can't satisfy the chore: release v PR title gate for publish.yml.

matthew-dean · 2026-03-18T17:21:35Z

@copilot I merged #4427 after this. Why didn't it create a PR for the release? Please investigate and fix it.

Copilot

Pull request overview

Introduces a PR-based release flow for master to keep npm publishes aligned with the corresponding version-bump commit, Git tag, and GitHub release—while retaining the existing direct-push publishing flow for alpha.

Changes:

Add a new workflow to automatically create/update a chore: release vX.Y.Z PR after package changes land on master.
Change the publish workflow so master publishes only when a release PR is merged (and alpha continues to publish on direct pushes).
Update the publish script to avoid pushing master directly and to push only tags for master releases.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
`scripts/bump-and-publish.js`	Adjusts push behavior to avoid pushing `master` directly; pushes tags for releases.
`.github/workflows/publish.yml`	Switches `master` publishing to occur on merged release PRs; keeps `alpha` on push with additional guards.
`.github/workflows/create-release-pr.yml`	Adds automation to create/update a release PR that bumps versions after package changes merge to `master`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+  // For master the version-bump commit already lives in master (it came from
+  // the release PR).  Only push the git tag — tag pushes bypass branch
+  // protection "require pull request" rules.
+  // For alpha (direct-push branch) we still push the bump commit to the branch.
+  if (!isMaster) {
+    console.log(`📤 Pushing to ${branch}...`);
+    if (!dryRun) {
      execSync(`git push origin ${branch}`, { cwd: ROOT_DIR, stdio: 'inherit' });
-      execSync(`git push origin "${tagName}"`, { cwd: ROOT_DIR, stdio: 'inherit' });
-    } catch (e) {
-      console.log(`⚠️  Push failed, but continuing with publish...`);
+    } else {
+      console.log(`   [DRY RUN] Would push to: origin ${branch}`);
    }
+  }
+
+  console.log(`📤 Pushing tag ${tagName}...`);
+  if (!dryRun) {
+    execSync(`git push origin "${tagName}"`, { cwd: ROOT_DIR, stdio: 'inherit' });
  } else {


      console.error(`   - ${name}: ${error}`);
    });
-    console.error(`\n⚠️  Note: Version bump and commit were successful.`);
+    console.error(`\n⚠️  Note: Version bump commit and tag were pushed successfully.`);


+          git add package.json packages/*/package.json
+          if git diff --cached --quiet; then
+            echo "No version changes; branch is already at v${NEXT_VERSION}"
+          else
+            git commit -m "${TITLE}"
+          fi
+
+          # --force-with-lease refuses to overwrite if the remote has advanced
+          # past what we fetched, which protects against concurrent workflow
+          # runs.  This is intentional: if two code PRs land simultaneously the
+          # second run will fail-fast here and the release branch stays coherent.
+          git push origin "${RELEASE_BRANCH}" --force-with-lease
+
+          # Open a PR if one doesn't already exist for this version.
+          EXISTING=$(gh pr list --head "${RELEASE_BRANCH}" --base master \
+            --json number --jq '.[0].number' 2>/dev/null || echo "")
+
+          if [ -z "${EXISTING}" ]; then
+            BODY="## Release v${NEXT_VERSION}


matthew-dean · 2026-03-19T17:56:21Z

@copilot Okay can you make a new PR with fixes that will make a merge to master CORRECTLY make a release PR?

* fix(issue#4339): limit whitespace check * Fix issue #4339 by limiting the whitespace check for the deprecation notice to not produce false positives. * fix(issue#4339): correct deprecation notice * Correct deprecation notice for issue #4339. * fix:(issue#4397): container query variable names * Fix for issue #4397 container query with variable names like @container @foo () {}. * feat(deprecation): add deprecation warnings for features removed in Less 5.x New deprecation infrastructure with automatic repetition limiting (max 5 per type): - deprecation.js: registry of deprecation IDs with descriptions - Parser warn() accepts deprecation IDs for categorized warnings - --quiet-deprecations: suppress only deprecation warnings (keeps other warnings) New deprecation warnings for features being removed in 5.x: - js-eval: inline JavaScript backtick expressions - at-plugin: @plugin directive Existing warnings now tagged with stable IDs: - mixin-call-no-parens, mixin-call-whitespace, dot-slash-operator - variable-in-unknown-value, property-in-unknown-value CLI deprecation notices for: --js, --line-numbers, --math=always * feat(benchmark): add historical benchmark suite with per-system result tracking Results organized as: results/latest/{system-id}.json - most recent per system results/runs/{date}_{system-id}.json - historical archive (gitignored) * fix(benchmark): don't path.resolve bare package names in benchmark-runner path.resolve('less') turns the package name into an absolute filesystem path, preventing Node's package resolution from finding npm-installed versions. Only resolve relative paths starting with '.'. * fix(benchmark): use coefficient of variation instead of range for variance_pct variance_pct was computing (max-min)/avg which is range-over-mean. Now uses stddev/avg (coefficient of variation) which is a proper variability statistic. * fix(benchmark): use timestamp instead of date for run filenames Prevents same-day runs from overwriting each other in the runs/ archive. * fix(cli): queue deprecation warnings until after arg parsing Deprecation warnings from flags like --js, --line-numbers, and --math=always were printed immediately during arg parsing, so --quiet-deprecations only worked if it appeared before the deprecated flag. Now all CLI deprecation messages are queued and flushed after parsing completes, respecting --silent, --quiet, and --quiet-deprecations regardless of flag order. * Remove duplicate length check from expression.genCSS() (#4327) Follows-up 53f84f02bad6e, which started the conditional with a check for `i + 1 < this.value.length`, which is the same as the parent block. * Remove unused `parsers.entities.propertyCurly()` (#4271) Follows-up a38f8a1eb7beed589d2fa734fcf411cf4461d231, which introduced this as part of implementing property accessors. The method was not used there, and hasn't been used elsewhere since then either. Ref https://github.com/less/less.js/pull/3163. * Remove redundant return from `parsers.blockRuleset()` (#4265) * chore: replace deprecated String.prototype.substr() (#3702) .substr() is deprecated so we replace it with .slice() which works similarily but isn't deprecated Signed-off-by: Tobias Speicher <rootcommander@gmail.com> * Handle the lack of the optional dependencies (#3791) * Handle optional dependencies * Handle optional dependency image-size * remove phantom stuff (#3782) * remove phantom stuff * lint fix * use deep clone * fixed bug in import subpath module (#4236) * fix(issue#4354): unknown at-rule expression commas (#4389) * Fix issue less#4354 unknown at-rule expressions should not have commas in a keyword list. * Add some additional layer at-rule tests. * chore: update README.md copyright (#4386) * Update README.md copyright year. * Fix no-prototype-builtins issues in Ruleset and ToCSSVisitor (#4404) Co-authored-by: Timo Tijhof <krinkle@fastmail.com> * chore: add test for number with underscore parsing (#4406) In Less.js 2.6.0, parsing of dimensions changed so that `5_large` is seen as one value, instead of as a list containing "5" and "_large". In updating the Less.php port, we forgot to consider this change because none of the Less.js 3.13 tests seem to cover this behavior. Follows-up https://github.com/less/less.js/pull/2485. This adds the test case from https://github.com/less/less.js/issues/2462, as inpired by downstream https://gerrit.wikimedia.org/r/1197310. Co-authored-by: Timo Tijhof <krinkle@fastmail.com> * fix(#4331): exclude CSS at-rule keywords from declarationCall parsing (#4407) * fix(#4331): exclude CSS at-rule keywords from declarationCall parsing * fix(#4331): normalize spacing after CSS at-rule keywords in media queries When `and`, `or`, `not`, or `only` keywords appear without a space before `(` in media queries, ensure spacing is added in the output to produce valid CSS. * fix(#4358): resolve parent selectors in comma-separated pseudo-selector lists (#4408) * refactor: code quality cleanup for container queries and related code (#4409) * fix: correct import and error handling in style() function - Fix incorrect import: `Anonymous` was imported from '../tree/variable' instead of '../tree/anonymous' (worked by accident since Variable was imported on the line above) - Simplify switch/case with single case 0 to a plain if statement - Add explanatory comment to the catch block documenting why it exists (CSS pass-through for @container style() queries) * refactor: remove dead boolean logic in evalRoot() - Remove `allAmpersands` variable that was initialized to false and never set to true, making it dead code - Replace string-based ampersand detection (genCSS + regex) with direct element value checks, avoiding unnecessary AST-to-string conversion - Simplify boolean conditions that referenced the dead variable * fix: add missing parserInput.forget() in colorOperand The colorOperand parser rule called parserInput.save() but only called restore() on failure, missing the forget() call on the success path. * refactor: QueryInParens eval() returns new node instead of mutating this QueryInParens.eval() was mutating `this` directly instead of returning a new node, violating the core Less.js tree pattern. It also used a brittle queue pattern where deep copies were pushed to an `mvalues` array during eval() and shifted off during genCSS(). Now eval() creates and returns a new QueryInParens with evaluated children, and genCSS() reads directly from the node's properties. The `copy-anything` import is removed from this file (still used elsewhere in the codebase). * refactor: extract mergeRules into shared utility to fix AtRule layering violation AtRule.eval() was directly calling ToCSSVisitor.prototype._mergeRules, which breaks the architectural boundary between tree nodes and visitors. Extract the merge logic into a standalone utility (merge-rules.js) that both AtRule.eval() and ToCSSVisitor can use without coupling. * fix: remove Container copy-paste duplication and fix evalNested splice index bug Container was overriding evalNested, permute, and bubbleSelectors with identical copies of the methods already provided by NestableAtRulePrototype. Remove the redundant overrides so Container properly inherits from the shared prototype. Also fix a bug in NestableAtRulePrototype.evalNested where context.mediaBlocks.splice(i, 1) used `i` (the index into `path`) to splice `mediaBlocks`. These are different arrays with different contents, so the index was wrong. Use indexOf(this) to find the correct position. * perf: optimize hot paths and fix benchmark infrastructure (#4410) * fix(benchmark): fix division in benchmark files for v4 math defaults Wrap bare divisions inside percentage() calls in extra parens so benchmarks work with v4's default parens-division math mode. Add --math option passthrough to benchmark-runner.js and pass --math=always in run-historical.sh for consistent cross-version results. * perf: remove unnecessary closures in hot paths - Remove `extendVisitor` alias in findMatch, use `this` directly - Replace IIFE closure for functionRegistry lookup in Ruleset.eval with inline loop ~5% improvement on main benchmark (median 38.6ms → 37.1ms) * perf: replace forEach/map closures with for loops in hot paths - Selector.eval: replace map() closures with pre-allocated for loops - Ruleset transformDeclaration: replace forEach with for loop - extend-visitor visitRuleset: replace forEach with for loop, cache extend and pathCount to reduce repeated property access Combined with previous commit: ~8% improvement on 104KB benchmark (median 38.6ms → 36.4ms) * fix(benchmark): handle all v3.12+/v4.x build scenarios - Use pnpm for v4.3+ (workspace: protocol) - Fallback tsc installation when npm can't install locally - Install runtime deps separately when npm fails due to unpublished workspace packages (@less/test-import-module) - Use last patch version of each minor release - Skip v3.13.x (broken source: missing tree/util.js) * bench: update benchmark results after hot-path optimizations Median: 39.07ms → 34.32ms (~12% improvement) Throughput: 2,495 KB/s → 2,828 KB/s System: macbook-pro arm64 * bench: add historical benchmark results and track runs in git - Add historical benchmark data (v3.5–v4.2) to results/runs/ - Update latest/ with all versions including v4.5.0-dev optimized results - Format JSON with 2-space indentation - Update .gitignore to track runs/ (historical records belong in git) * bench: full historical benchmark run (v2.0–v4.5, 23 versions) Apple M4 Pro, arm64, Node v18/v20/v24 Key findings: - v2.4-v2.5 fastest era (~31ms median on 104KB file) - v3.10-v3.12 massive regression (3-5x slower, 126-185ms) - v4.0 recovered to ~40ms - v4.2 fastest v4.x (35.4ms) - v4.5.1 current master: 42.2ms * bench: prune version list to significant performance changes Reduced from 23 to 15 versions based on full benchmark data. Dropped versions with <5% difference from their predecessor: - v2.1 (broken), v2.5, v2.7 (plateau with v2.4/v2.6) - v3.6–v3.9 (all within 1ms, flat ~41ms) - v4.1 (identical to v4.0) The full set can still be run with --versions flag. * feat: migrate to native ESM with no build step (#4411) * feat: migrate to native ESM with no build step - Rename src/ to lib/ — source files are shipped directly, no compilation - Add "type": "module" to package.json for native ESM support (Node 18+) - Convert bin/lessc, test files, and build scripts from CJS to ESM - Rename Gruntfile.js and .eslintrc.js to .cjs (must remain CommonJS) - Add .js extensions to all relative import paths for ESM resolution - Use createRequire() for optional dependency resolution (npm packages, JSON) - Configure TypeScript for check-only mode (noEmit: true, allowJs: true) - Update Rollup config to read from lib/ directly - Update CI matrix to drop Node 16 (minimum Node 18+) - Browser build is smaller: 500KB (was 509KB), minified 153KB (was 158KB) - All 139 tests pass * chore: fix trailing semicolons from linter * chore: gitignore generated .css.map files in lib/ * fix(ci): restore lts/-3 to test matrix * chore: stop tracking dist/ build artifacts Generated browser bundles don't need to be in source control — they're built during publish and included in the npm package via the files field. Removes duplicate copies from both root dist/ and packages/less/dist/. * fix(ci): use pnpm exec for playwright install npx doesn't reliably find binaries with pnpm. Since playwright is already a devDependency, use pnpm exec to run the installed version. * fix(ci): use pnpm --filter for playwright, disable fail-fast pnpm exec at workspace root can't find playwright binary since it's a devDependency of the less package. Use --filter to run in that context. Also disable fail-fast so all matrix jobs complete independently. * fix(ci): move playwright to root devDependencies Makes pnpm exec playwright work from workspace root in CI. * fix: upgrade copy-anything to v3 for ESM compat, fix Windows test paths copy-anything v2 lacks "type": "module", causing named import failures on Node 18. v3 has proper ESM exports. Revert testFolder to absolute path (matching original behavior) so debug test path replacements match Less compiler output on Windows. * chore: add CodeRabbit config to raise file review limit * fix: add files field to package.json, remove postinstall from published package Restricts npm package to only bin/, lib/, dist/, index.js, and README.md. Previously shipped test files, Gruntfile, eslint config, etc. Removes postinstall script (Playwright browser install) which only applies in the monorepo dev environment and fails when installed from npm. Verified: npm pack --dry-run shows 120 files (was 229), lessc CLI and API both work from a clean tarball install. * refactor: convert prototype-based tree nodes to ES6 classes (#4412) * refactor: convert prototype-based tree nodes to ES6 classes Convert all 30 tree node files from `Object.assign(new Node(), {...})` prototype pattern to proper `class extends Node` syntax. This enables TypeScript to understand the inheritance chain, reducing checkJs errors from 2756 to 0. - All tree nodes now use `class X extends Node` (or appropriate parent) - Node.type converted from instance property to getter for clean override - Factory functions in index.js updated to use `new` instead of Object.create + apply (required for ES6 class compatibility) - Benchmark script converted to ESM - Added @types/node devDependency for checkJs support - Enabled checkJs in tsconfig.json - Added JSDoc types to node.js base class and several utility files No behavioral changes - all 139 tests pass, benchmark performance unchanged vs historical baselines (avg 36-39ms for 104KB). * fix: @plugin deprecation says "replaced" not "removed" * fix: use constructor params for AtRule selectors, path.resolve in benchmark * fix: align @types/node with engines.node >=18 floor * feat: JSDoc type annotations for all tree node files (#4413) * feat: add JSDoc type annotations with @ts-check to all tree node files Add proper JSDoc type annotations to all 44 files in lib/less/tree/, enabling per-file TypeScript checking via @ts-check. No {*} or {any} casts — all types are derived from reading the actual code. Key changes: - Shared types (EvalContext, CSSOutput, TreeVisitor, FileInfo, VisibilityInfo) defined in node.js - Node.value typed as union: Node | Node[] | string | number | undefined - Node.prototype.parse declared for parser-injected prototype property - Constructor properties explicitly declared with proper types - Inline casts used to narrow union types at usage sites - Widened base class params where subclasses pass different types Also adds typecheck to prepublishOnly and pre-commit hook to catch regressions as more files are annotated toward global checkJs: true. All 139 tests pass, zero TypeScript errors. * fix: remove duplicate JSDoc type annotation in ruleset.js * fix: pre-existing bug fixes in tree nodes (#4414) * fix: preserve alpha 0 for fully transparent hex colors #0000 and #00000000 parsed alpha as 0 which was treated as falsy by the || operator, causing it to fall back to 1 (opaque). Use typeof check instead so alpha 0 is preserved. * fix: selector getElements callback `this` binding and forEach lint - Capture `this._fileInfo` and `this.parse.imports` into locals before the plain function callback in Selector.getElements(), where `this` is undefined in strict mode (ES modules) - Use explicit block in forEach to avoid implicit return of assignment * fix: preserve full error context when rethrowing mixin call errors The catch block in MixinCall.eval() only copied message and stack, dropping type, extract, callLine, and other LessError fields. This caused all mixin call errors to be reported as SyntaxError regardless of their actual type (e.g. NameError). Use spread to preserve all fields while still overriding index/filename to the call site. * fix: guard functionRegistry.inherit() and fix atrule parenting - Container and Media eval() now guard functionRegistry before calling .inherit(), matching mixin-definition.js defensive pattern - AtRule constructor: remove dead setParent(selectors) on orphaned local, parent this.declarations and this.rules with null checks * chore: release v4.6.0 (#4415) * chore: prepare v4.6.0 release - Bump version to 4.6.0 in all package.json files - Add CHANGELOG entry for v4.6.0 - Update publish workflow: replace deprecated actions/create-release with gh release create, attach dist files (less.js, less.min.js) as release assets, bump contents permission to write - Remove .github/** from paths-ignore (was preventing workflow updates) - Update CONTRIBUTING.md with detailed release documentation version: 4.6.0 * fix: publish workflow and provenance errors - Add repository field to test-data package.json (fixes npm OIDC provenance verification failure) - Skip publish workflow on forks (only run on less/less.js) - Remove duplicate require('fs') in bump-and-publish.js - Add language specifier to markdown code block in CONTRIBUTING.md * fix: handle existing releases for idempotent workflow re-runs * fix: CJS compatibility, enriched npm README, ESM tests (#4417) * docs: enrich npm README with usage examples and feature highlights version: 4.6.0 * fix: update README and tests to show ESM + promise/await usage The package is ESM-only ("type": "module"), so the README now correctly shows `import less from 'less'` with `await` instead of CJS `require()`. The ES6 test now verifies both promise/await and callback APIs. version: 4.6.0 * fix: add CJS compatibility wrapper so require('less') works Adds index.cjs as a one-line wrapper that re-exports the ESM default. The exports field now has both import and require conditions. Adds test-cjs.cjs to verify CJS consumption alongside the existing ESM test. version: 4.6.0 * fix: lazy Proxy CJS wrapper for Node 18+ compatibility Node 22+ uses native require(esm). Node 18-20 uses a lazy Proxy with dynamic import() — transparent because render()/parse() already return promises. Tested with render, callback, and version property access. * fix: include Node 20.19+ in native require(esm) path * fix: add alt text to README images for accessibility * fix: publish script skips stale version markers in squash merges (#4418) * fix: skip stale version markers in squash merge commit messages When a squash merge includes commit messages with `version: X.Y.Z` from a previous release, the publish script would use that version instead of auto-incrementing. Now checks if the requested version already has a tag — if so, skips it and falls through to auto-increment. * fix: simplify publish version logic — compare package.json vs NPM Remove commit message version parsing entirely. The publish script now: 1. Checks EXPLICIT_VERSION env var (override) 2. If package.json > NPM version, uses package.json 3. Otherwise, bumps from latest NPM patch version Updated CONTRIBUTING.md to reflect simplified workflow. * chore: remove .claude directory and add to .gitignore (#4419) * chore: remove .claude directory and add to .gitignore * ci: skip publish for .gitignore and .claude changes * fix: webpack browser build - use UMD dist/less.js, add CJS bundle (#4424) * fix: webpack browser build - use UMD dist/less.js, add CJS bundle (#4423) - Browser exports point to dist/less.js (UMD) instead of less-node - Add CJS bundle (dist/less-node.cjs) for Node require() with module shim - Remove dead index.js; index.cjs re-exports CJS bundle - Add export tests: import-patterns, webpack-browser, test-cjs-suite - CI and publish workflows run test:node (build + CJS + ESM tests) * Beta publish script * chore: clarify test:node runs ESM + CJS in workflow labels * fix: normalize path separators in rollup plugin for Windows CI The inlinePackageVersion plugin used forward-slash path check that failed on Windows where rollup passes backslash-separated IDs, leaving the require('../../package.json') unresolved at runtime. * chore: bump version to 4.6.3 for release * test: Add coverage for :is()/:matches()/:where() containing nested :has() selectors and comma-separated lists (#4422) * Initial plan * Initial plan Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> * test: add test cases for :is()/:matches() containing :has() (fixes #4378) Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> * test: add :where() and comma-separated list test cases for pseudo-selectors Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> Co-authored-by: Matthew Dean <matthew-dean@users.noreply.github.com> * fix: ensure npm publish is always backed by a GitHub tag, release, and version-bump commit (#4430) * Initial plan * fix: prevent npm publish when GitHub push fails, skip workflow on version bump commits Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> * fix: skip version-bump commit entirely, push only the tag to bypass branch protection Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> * fix: restore version-bump commit + push to master, add infinite-loop guard Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> * fix: exclude .github and scripts from publish workflow trigger Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> * feat: implement PR-based release flow for master Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> * fix(less): upgrade make-dir to v4 to fix security vulnerability (#4426) Co-authored-by: Matthew Dean <matthew-dean@users.noreply.github.com> * fix(issue#4356): parenthesis in media query (#4427) * Fix issue #4356 issue with parenthesis in media query. * Add tests for issue #4356. Co-authored-by: Matthew Dean <matthew-dean@users.noreply.github.com> * feat: PR-based release flow for alpha; test suite proving all three release properties (#4431) * Initial plan * fix: correct release automation for master merges and publishing - create-release-pr.yml: add set -euo pipefail; track whether a commit was created; skip push + gh pr create when no version changes (no-op safety - fixes the "no commits between head and base" failure). - scripts/bump-and-publish.js: on master, use the version already in package.json as-is (no auto-increment). Validate it is > NPM version. Skip updateAllVersions/git-add/git-commit on master so the published tag always points to the release PR merge commit on master, not to a local detached commit. Alpha behavior is unchanged. - Fix error message: on master say "Git tag was pushed" rather than "Version bump commit and tag were pushed". Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> * test: add release automation test suite (20 tests) Proves the three components of the release flow work correctly: - publish.yml if: conditions (6 scenarios) - create-release-pr.yml if: conditions (4 scenarios) - bump-and-publish.js master path: existing version, no commit, no push (4 tests) - bump-and-publish.js alpha path: auto-increment, commit, alpha tag (4 tests) - create-release-pr no-op safety: commit when needed, clean exit when not (2 tests) Run with: node scripts/test-release-automation.js or: npm run test:release (after pnpm install) Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> * plan: implement PR-based release flow for alpha branch Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> * feat: PR-based release flow for alpha branch (mirrors master) - create-release-pr.yml: listen on alpha push; compute alpha version increment (X.Y.Z-alpha.N → X.Y.Z-alpha.N+1); use branch-specific PR title/base/branch naming; update loop guards for both flavours - publish.yml: remove push:alpha trigger; add alpha to pull_request branches; update if: condition for alpha release PR title+base - bump-and-publish.js: remove auto-increment/commit/push for alpha; add getNpmAlphaVersion(); alpha now validates and publishes like master - test-release-automation.js: 34 tests covering new flows end-to-end Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> * Fix `not` keyword silently ignored when used without parentheses in conditions (#4421) * Initial plan * Fix: not keyword now works without parentheses in guard conditions Previously, `boolean(not false)` silently ignored the `not` keyword while `boolean(not (false))` worked correctly. The `negatedCondition` parser function consumed the `not` keyword but only tried `parenthesisCondition`, which requires `(`. With no parens, it returned undefined with `not` already consumed, causing silent skip. Fix: fall back to `atomicCondition` when `parenthesisCondition` fails, allowing both `not false` and `not (false)` to work consistently. Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> * Restrict not-without-parens to simple values only (keywords/variables) Complex conditions like `not 2 < 1` still require parentheses, keeping alignment with CSS media query syntax. Only simple bare values (keywords, variables, quoted strings) are allowed after `not` without parens: `not false`, `not @var`. Remove the `boolean(not 2 < 1)` test case that relied on the broader atomicCondition fallback. Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> Co-authored-by: Matthew Dean <matthew-dean@users.noreply.github.com> * test: regression test for @container mixin parameter variable resolution (#4420) * Initial plan * Initial plan: add regression test for container mixin parameters issue Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> * test: add regression test for container mixin parameters issue (#4420) Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> Co-authored-by: Matthew Dean <matthew-dean@users.noreply.github.com> * fix: update packageManager to pnpm@9.15.9 to match lockfileVersion 9.0 in pnpm-lock.yaml (#4432) * Initial plan * fix: trigger create-release-pr on any push to master/alpha, not just packages/** Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> * fix: update packageManager to pnpm@9.15.9 to match lockfileVersion 9.0 Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com> * ci: fix Playwright chromium install hang on Node current/lts/* (#4445) * ci: fix Playwright chromium install hang on Node current/lts/* The `playwright install chromium` step was hanging for 1h+ on jobs using Node `current` and `lts/*` after the 163 MiB download completed (post-download extraction/setup blocked indefinitely). Fixes: - Add `timeout-minutes: 5` to fail fast instead of burning a runner for 6 hours - Add `--with-deps` to install required system libraries (likely cause of the hang) - Cache Playwright browser binaries via `actions/cache` using `PLAYWRIGHT_BROWSERS_PATH` pointed at `${{ github.workspace }}/.playwright-browsers` (cross-platform) Older LTS jobs (lts/-1, lts/-2, lts/-3) were unaffected and completed fine. * Refactor CI workflow for improved clarity The `Install chromium` step was causing CI to hang indefinitely on Node current/lts/* (and timeout when we added a 5-min limit). Root cause: `test:node` only runs grunt node tests and has no browser dependency, so installing Chromium was never necessary in the first place. Also drops the unused `env: PLAYWRIGHT_BROWSERS_PATH` and `actions/cache` step added in the previous commit. * Fix browser export interop by routing bundlers to CJS-typed UMD artifact (#4444) * Initial plan * Fix browser export to CJS dist entry for bundler interop --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Matthew Dean <matthew-dean@users.noreply.github.com> * Add Copilot review request job to CI workflow Added a new job to request Copilot review for pull requests. * fix: add continue-on-error to copilot-review CI job (#4448) Updated CI workflow to include 'continue-on-error' for copilot-review job. * chore: automate CHANGELOG generation in release workflow (#4447) * chore: automate CHANGELOG generation in release workflow Updated comments for clarity and consistency in the release PR workflow. * fix: correct bash escaping in PR body template Fix typo in push event and update release message format. * chore: release v4.6.5 (#4436) * chore: release v4.6.5 * docs: add CHANGELOG entries for v4.6.1 through v4.6.5 --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Matthew Dean <matthew-dean@users.noreply.github.com> * fix: correct push event typo in create-release-pr workflow (pus → push:) (#4449) * fix: use printf for PR body to avoid YAML indentation error in run block (#4450) Removed redundant line from PR body in release workflow. * docs: fix incorrect contributor attributions in v4.6.0 changelog (#4437) Seven entries under v4.6.0 credited @nicolo-ribaudo for PRs authored by other contributors. Updated each entry to match the actual PR author. Fixes #4428 * chore: prevent dependency lifecycle scripts (#4440) * chore: prevent dependency lifecycle scripts * Prevent dependency lifecycle scripts during CI work. * fix: partial revert for CI run * Partial revert of CI run; keep only frozen lockfile so CI can complete. * fix: CI hang on chromium install * Fix CI hang on chromium install; should not be needed for CI test purposes. * chore: re-add dependency script ignore for CI * Re-add dependency script ignore for CI now that chromium hang is resolved and CI can complete. --------- Co-authored-by: Matthew Dean <matthew-dean@users.noreply.github.com> * fix(issue#4316): color calc inside from expression (#4434) * Fix color calc() inside from expression parsing issues. * Add tests for #4316. Co-authored-by: Matthew Dean <matthew-dean@users.noreply.github.com> * fix: avoid crash on nested @supports with dumpLineNumbers (#4446) A nested @supports (or @document) builds an implicit, non-root ruleset that never gets a debugInfo attached during parsing. With dumpLineNumbers enabled, genCSS tried to read lineNumber/fileName off that missing debugInfo and threw a TypeError instead of producing output. Skip emitting debug info when a node has none, the same way nodes without a recorded line are already handled elsewhere. * Preserve spacing for container feature functions (#4441) * Preserve container feature function spacing Signed-off-by: Puneet Dixit <236133619+puneetdixit200@users.noreply.github.com> * Handle non-ASCII container names --------- Signed-off-by: Puneet Dixit <236133619+puneetdixit200@users.noreply.github.com> Co-authored-by: Puneet Dixit <236133619+puneetdixit200@users.noreply.github.com> * chore: release v4.6.6 (#4451) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * Fix failing "Request Copilot review" CI job (#4457) * Initial plan * Fix failing Request Copilot review CI job by handling 403 gracefully --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> * chore: release v4.6.7 (#4458) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * feat: deprecate bare @variable in non-value at-rule positions (#4462) * feat: deprecate bare @variable in non-value at-rule positions Bare @var in at-rule preludes, names, and identifiers is deprecated in favour of @{foo} interpolation; the bare form still resolves, so this is a warning only (id: variable-in-at-rule-prelude, respects --quiet-deprecations and the repetition cap). Covered positions: - @media / @container feature preludes - @supports / @document / unknown & custom at-rule preludes - @keyframes / @counter-style / @charset identifiers - @layer names and lists - @namespace prefix @{foo} interpolation is now accepted in these positions as the migration target (previously it errored in most of them). A bare @var in a nested declaration value -- e.g. @supports (display: @v) or @media (min-width: @v) -- is NOT deprecated: it is a declaration value and stays valid, detected via paren-depth awareness so parsing and output are unchanged. Value-position parsing is otherwise untouched: @var works, @{var} is not newly accepted in top-level declaration values. Migrates existing fixtures to @{var} and adds a dedicated fixture locking in backward-compatible resolution of the bare form. * fix: also deprecate @@variable-variable prefix in @namespace The @namespace prefix lookahead used `@[\w-]`, which misses an indirect `@@ref` (variable-variable) reference — entities.variable() accepts `@@name`, so `@namespace @@ref "..."` fell through to expression() and resolved without the deprecation warning. Widen the lookahead to `@@?[\w-]` so @@-prefixes hit the same warning path. Adds fixture coverage. * Fix #4460: parse comparison/range syntax in container style() queries (#4461) * Fix #4460: parse comparison/range syntax in container style() queries The mediaFeature lookahead regex only matched a bare identifier before a comparison operator (=, >, <, >=, <=), so it failed whenever the operand was a function call, e.g. var(--n) or calc(6/2). Widened the regex to also match a single level of balanced parens before the operator. Added regression tests covering: @container style(var(--n) = 3) @container style(calc(6 / 2) = var(--n)) @container style(var(--size) > 1lh) * Refactor parser.js for improved readability --------- Co-authored-by: dweep <existing1.001@gmail> * refactor: extract shared ESLint config and add lint scripts (#4459) * refactor: extract shared ESLint config and add lint scripts Addresses discussion #3787 by extracting shared ESLint rules to config/eslint/base.cjs and adding lint/lint:fix npm scripts. Changes: - Created config/eslint/base.cjs with common ESLint rules - Updated packages/less/.eslintrc.cjs to extend the shared config - Added lint and lint:fix scripts to root package.json The shared config maintains compatibility with both JS and TS files. TypeScript-specific recommended rules are scoped to .ts files only to avoid noise in legacy .js source files. Verified: pnpm run lint passes with zero errors, 139/139 unit tests pass (pre-commit hook failed only on unrelated port conflict). * style: apply eslint --fix formatting Auto-generated by 'pnpm run lint:fix' using the new shared config. Touches only quote style and indentation; no logic changes. - benchmark/benchmark-runner.js: indent - build/rollup.js: quotes (backtick -> single) - lib/less-node/environment.js: indent - lib/less/tree/nested-at-rule.js: indent * test(benchmark): add JSDoc for coverage Addresses docstring coverage warning in PR #4459 by adding full JSDoc to all functions in the benchmark-runner script. * Replace image-size with probe-image-size (#4456) * Replace image-size with probe-image-size * validation * Use loaded contents for image size probing * Use loaded contents for image size probing * chore: release v4.6.8 (#4463) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * Follow-up to #4462: migrate remaining @var fixtures, DRY the prelude bare-@var scan, add warnings coverage (#4469) * test: migrate remaining bare @variable at-rule fixtures to @{variable} Follow-up to #4462, which deprecated bare @variable in non-value at-rule positions and migrated most fixtures to @{variable} but left two feature fixtures on the bare form: - tests-unit/layer/layer.less @layer @layer-name - tests-unit/import/import/import-reference.less @keyframes @keyframeName Migrated to @{layer-name} / @{keyframeName} (byte-identical render). Also repairs pnpm-lock.yaml: master had a dangling `minimatch: 3.1.2` dependency edge with no package entry (bad-merge artifact), so `pnpm install --frozen-lockfile` failed for every PR. Repinned to the resolved 3.1.5 already present; no dependency version changes. * test: assert deprecation/warning emission + suppress warnings in test output less.js asserts errors via tests-error/*.txt but had no coverage that warnings actually fire, so deprecation notices were unguarded (nothing would catch a regression that silently stopped emitting one). - Suppress warnings from normal test output (they are noise across the corpus); set LESS_TEST_SHOW_WARNINGS=1 to see them. - Add testWarnings() (run from index.js) which installs a capturing logger listener and asserts each render-reachable warning fires: variable-in-at-rule- prelude (incl. bar[@v] top-level -> warns and (x:@v) decl-value -> no warn), js-eval, mixin-call-whitespace, mixin-call-no-parens, variable-in-unknown-value, dot-slash-operator, complex-selector, extend-no-match, compress, at-plugin. Documented gaps (not render-reachable): property-in-unknown-value (a $prop ref resolves via the entity path before the permissive text scan), math-always and dumpLineNumbers (registered in deprecation.js but never emitted via warn()). * refactor(parser): fold at-rule prelude bare-@var detection into $parseUntil (DRY) The at-rule-prelude deprecation detected a top-level bare @var two ways: the permissiveValue entity loop (structural), plus a standalone hasTopLevelBareVariable() that RE-SCANNED the same text $parseUntil had already walked, with its own hand-rolled paren counter (and no string/comment handling). Fold that second scan into $parseUntil's single pass: it already skips strings/comments/ escapes and tracks brackets, so add an opt-in `detectBareVar` that records the first bare @var (not @{interp}) seen at PAREN depth 0 — [...]/{...} don't shield a reference, only a declaration-value (...) does — exposed as `.bareVarIndex`. $parseUntil has a single caller (permissiveValue), so the extra arg/property is contained. Delete hasTopLevelBareVariable. Behaviour preserved (regression-guarded by testWarnings): @foo @bar -> 1, @a and @b -> 2, bar[@v] -> 1 (bracket is top-level), (x:@v) -> 0 (decl value), and the mixed (a:@x) y[@z] -> 1. Also drops the testWarnings 'variable-in-unknown-value' case: it only fires for the inconsistent bracket edge (--x: bar[@bar]) while --x: @bar / 1px @bar / foo(@bar) resolve silently, so asserting it would lock in an artifact (now documented). * chore: release v4.7.0 (#4471) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * Fix boolean() parsing for comparisons between inline condition expressions (#4472) * Initial plan * Fix boolean comparison of inline condition expressions --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> * fix(mixing): resolves issue #4234 (#4473) * Fix mixin arity issue for mixins that provide a default value for arguments early in the list that caused wrong number of arguments error. * chore: release v4.8.0 — deprecate legacy identifier forms and dynamic @charset (#4475) * test: migrate remaining bare @variable at-rule fixtures to @{variable} Follow-up to #4462, which deprecated bare @variable in non-value at-rule positions and migrated most fixtures to @{variable} but left two feature fixtures on the bare form: - tests-unit/layer/layer.less @layer @layer-name - tests-unit/import/import/import-reference.less @keyframes @keyframeName Migrated to @{layer-name} / @{keyframeName} (byte-identical render). Also repairs pnpm-lock.yaml: master had a dangling `minimatch: 3.1.2` dependency edge with no package entry (bad-merge artifact), so `pnpm install --frozen-lockfile` failed for every PR. Repinned to the resolved 3.1.5 already present; no dependency version changes. * test: assert deprecation/warning emission + suppress warnings in test output less.js asserts errors via tests-error/*.txt but had no coverage that warnings actually fire, so deprecation notices were unguarded (nothing would catch a regression that silently stopped emitting one). - Suppress warnings from normal test output (they are noise across the corpus); set LESS_TEST_SHOW_WARNINGS=1 to see them. - Add testWarnings() (run from index.js) which installs a capturing logger listener and asserts each render-reachable warning fires: variable-in-at-rule- prelude (incl. bar[@v] top-level -> warns and (x:@v) decl-value -> no warn), js-eval, mixin-call-whitespace, mixin-call-no-parens, variable-in-unknown-value, dot-slash-operator, complex-selector, extend-no-match, compress, at-plugin. Documented gaps (not render-reachable): property-in-unknown-value (a $prop ref resolves via the entity path before the permissive text scan), math-always and dumpLineNumbers (registered in deprecation.js but never emitted via warn()). * refactor(parser): fold at-rule prelude bare-@var detection into $parseUntil (DRY) The at-rule-prelude deprecation detected a top-level bare @var two ways: the permissiveValue entity loop (structural), plus a standalone hasTopLevelBareVariable() that RE-SCANNED the same text $parseUntil had already walked, with its own hand-rolled paren counter (and no string/comment handling). Fold that second scan into $parseUntil's single pass: it already skips strings/comments/ escapes and tracks brackets, so add an opt-in `detectBareVar` that records the first bare @var (not @{interp}) seen at PAREN depth 0 — [...]/{...} don't shield a reference, only a declaration-value (...) does — exposed as `.bareVarIndex`. $parseUntil has a single caller (permissiveValue), so the extra arg/property is contained. Delete hasTopLevelBareVariable. Behaviour preserved (regression-guarded by testWarnings): @foo @bar -> 1, @a and @b -> 2, bar[@v] -> 1 (bracket is top-level), (x:@v) -> 0 (decl value), and the mixed (a:@x) y[@z] -> 1. Also drops the testWarnings 'variable-in-unknown-value' case: it only fires for the inconsistent bracket edge (--x: bar[@bar]) while --x: @bar / 1px @bar / foo(@bar) resolve silently, so asserting it would lock in an artifact (now documented). * deprecate dash-only variable names * deprecate dynamic charset interpolation * chore: release v4.8.0 * chore: release v4.8.0 (#4474) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Matthew Dean <matthew-dean@users.noreply.github.com> * fix: forwarding an unset variadic no longer overrides callee defaults (#4477) Signed-off-by: 林晨 (Leo Cheng) <leo-cheng@vip.qq.com> * fix: leave math functions for the browser when an argument is a runtime CSS var() (#4479) Signed-off-by: 林晨 (Leo Cheng) <leo-cheng@vip.qq.com> * fix(release): sync release version from PR title (#4483) * fix(release): sync release version from PR title * fix(release): harden title sync automation * fix(release): harden title sync workflow * fix(release): make changelog title sync idempotent * fix(release): insert missing changelog heading on title sync * fix(release): insert changelog heading without prior releases * chore: release v4.8.1 (#4482) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * Less 5 alpha.1: Jess-powered compiler preview (#19) * fix(issue#4339): limit whitespace check * Fix issue #4339 by limiting the whitespace check for the deprecation notice to not produce false positives. * fix(issue#4339): correct deprecation notice * Correct deprecation notice for issue #4339. * Some updated tests for Less v5 * Update various acceptance tests for new parser * Lots of v5 syntax tweaks * Unit test updates for v5 - atrules * v5 updates in test expectations * Extend stylesheet changes * fix:(issue#4397): container query variable names * Fix for issue #4397 container query with variable names like @container @foo () {}. * Update unit tests to Less v5 engine * Rebaseline test-data fixtures and move removed legacy JavaScript cases. This updates expected outputs for current behavior and relocates removed inline-JavaScript and IE filter fixtures into explicit legacy/REMOVED folders to preserve historical references. * Rebaseline import/media fixtures and skip alpha pre-commit test gate. This updates import/media fixture expectations and moves the previous media v5 snapshot into legacy while keeping current output at media.css, and bypasses pre-commit verification on the alpha branch during broad migration work. * test-data: update mixin fixture baselines with legacy snapshots Capture accepted fixture output updates for mixin guard/default ordering and mixin output parity while preserving prior snapshots under legacy paths for traceability. * Update parse-interpolation fixtures for selector capture semantics. This removes the invalid quoted ampersand merge-template case from unit output expectations and moves it into tests-error/eval with an explicit invalid merge-template error fixture. * Add nesting fixture variants (legacy, uncollapsed, styles.config) * fix(test-data): update import-reference expected CSS for jess compat Update expected output to match jess's collapseNesting behavior: - Unwrap single-item :is() wrappers (.visible instead of :is(.visible)) - Simplify extend selectors (.visible + .visible instead of :is() form) - Add .b { color: green; } from bare & { } (matches lessc output) * fix(test-data): update extract-and-length expected CSS for @arguments semantics BREAKING: @arguments no longer flattens Sequence arguments. Passing .mixin(a b c d) to (...) gives @arguments length 1 (one Sequence), not 4 (individual items). Previous expected output saved to legacy/. * feat(benchmark): add historical benchmark suite for Less v2.0-v4.4 Comprehensive benchmark harness that tests every major/minor Less release using git worktrees for isolation and fnm for Node version management. - benchmark.less: enhanced with extend, guards, property merging, detached rulesets, complex nesting, color functions, loops, and more - benchmark-v3.less: v3.6+ features (if, boolean, property lookups) - benchmark-v37.less: v3.7+ features (each with lists/maps) - benchmark-v39.less: v3.9+ features (range for columns/spacing) - benchmark-runner.js: portable runner with ESM interop for v4.x - run-historical.sh: orchestrator with per-system result tracking Results organized as: results/latest/{system-id}.json - most recent per system results/runs/{date}_{system-id}.json - historical archive * feat(deprecation): add deprecation warnings for features removed in Less 5.x New deprecation infrastructure with automatic repetition limiting (max 5 per type): - deprecation.js: registry of deprecation IDs with descriptions - Parser warn() accepts deprecation IDs for categorized warnings - --quiet-deprecations: suppress only deprecation warnings (keeps other warnings) New deprecation warnings for features being removed in 5.x: - js-eval: inline JavaScript backtick expressions - at-plugin: @plugin directive Existing warnings now tagged with stable IDs: - mixin-call-no-parens, mixin-call-whitespace, dot-slash-operator - variable-in-unknown-value, property-in-unknown-value CLI deprecation notices for: --js, --line-numbers, --math=always * feat(benchmark): add historical benchmark suite with per-system result tracking Results organized as: results/latest/{system-id}.json - most recent per system results/runs/{date}_{system-id}.json - historical archive (gitignored) * fix(benchmark): don't path.resolve bare package names in benchmark-runner path.resolve('less') turns the package name into an absolute filesystem path, preventing Node's package resolution from finding npm-installed versions. Only resolve relative paths starting with '.'. * fix(benchmark): use coefficient of variation instead of range for variance_pct variance_pct was computing (max-min)/avg which is range-over-mean. Now uses stddev/avg (coefficient of variation) which is a proper variability statistic. * fix(benchmark): use timestamp instead of date for run filenames Prevents same-day runs from overwriting each other in the runs/ archive. * fix(cli): queue deprecation warnings until after arg parsing Deprecation warnings from flags like --js, --line-numbers, and --math=always were printed immediately during arg parsing, so --quiet-deprecations only worked if it appeared before the deprecated flag. Now all CLI deprecation messages are queued and flushed after parsing completes, respecting --silent, --quiet, and --quiet-deprecations regardless of flag order. * Remove duplicate length check from expression.genCSS() (#4327) Follows-up 53f84f02bad6e, which started the conditional with a check for `i + 1 < this.value.length`, which is the same as the parent block. * Remove unused `parsers.entities.propertyCurly()` (#4271) Follows-up a38f8a1eb7beed589d2fa734fcf411cf4461d231, which introduced this as part of implementing property accessors. The method was not used there, and hasn't been used elsewhere since then either. Ref https://github.com/less/less.js/pull/3163. * Remove redundant return from `parsers.blockRuleset()` (#4265) * chore: replace deprecated String.prototype.substr() (#3702) .substr() is deprecated so we replace it with .slice() which works similarily but isn't deprecated Signed-off-by: Tobias Speicher <rootcommander@gmail.com> * Handle the lack of the optional dependencies (#3791) * Handle optional dependencies * Handle optional dependency image-size * remove phantom stuff (#3782) * remove phantom stuff * lint fix * use deep clone * fixed bug in import subpath module (#4236) * fix(issue#4354): unknown at-rule expression commas (#4389) * Fix issue less#4354 unknown at-rule expressions should not have commas in a keyword list. * Add some additional layer at-rule tests. * chore: update README.md copyright (#4386) * Update README.md copyright year. * Fix no-prototype-builtins issues in Ruleset and ToCSSVisitor (#4404) Co-authored-by: Timo Tijhof <krinkle@fastmail.com> * chore: add test for number with underscore parsing (#4406) In Less.js 2.6.0, parsing of dimensions changed so that `5_large` is seen as one value, instead of as a list containing "5" and "_large". In updating the Less.php port, we forgot to consider this change because none of the Less.js 3.13 tests seem to cover this behavior. Follows-up https://github.com/less/less.js/pull/2485. This adds the test case from https://github.com/less/less.js/issues/2462, as inpired by downstream https://gerrit.wikimedia.org/r/1197310. Co-authored-by: Timo Tijhof <krinkle@fastmail.com> * fix(#4331): exclude CSS at-rule keywords from declarationCall parsing (#4407) * fix(#4331): exclude CSS at-rule keywords from declarationCall parsing * fix(#4331): normalize spacing after CSS at-rule keywords in media queries When `and`, `or`, `not`, or `only` keywords appear without a space before `(` in media queries, ensure spacing is added in the output to produce valid CSS. * fix(#4358): resolve parent selectors in comma-separated pseudo-selector lists (#4408) * refactor: code quality cleanup for container queries and related code (#4409) * fix: correct import and error handling in style() function - Fix incorrect import: `Anonymous` was imported from '../tree/variable' instead of '../tree/anonymous' (worked by accident since Variable was imported on the line above) - Simplify switch/case with single case 0 to a plain if statement - Add explanatory comment to the catch block documenting why it exists (CSS pass-through for @container style() queries) * refactor: remove dead boolean logic in evalRoot() - Remove `allAmpersands` variable that was initialized to false and never set to true, making it dead code - Replace string-based ampersand detection (genCSS + regex) with direct element value checks, avoiding unnecessary AST-to-string conversion - Simplify boolean conditions that referenced the dead variable * fix: add missing parserInput.forget() in colorOperand The colorOperand parser rule called parserInput.save() but only called restore() on failure, missing the forget() call on the success path. * refactor: QueryInParens eval() returns new node instead of mutating this QueryInParens.eval() was mutating `this` directly instead of returning a new node, violating the core Less.js tree pattern. It also used a brittle queue pattern where deep copies were pushed to an `mvalues` array during eval() and shifted off during genCSS(). Now eval() creates and returns a new QueryInParens with evaluated children, and genCSS() reads directly from the node's properties. The `copy-anything` import is removed from this file (still used elsewhere in the codebase). * refactor: extract mergeRules into shared utility to fix AtRule layering violation AtRule.eval() was directly calling ToCSSVisitor.prototype._mergeRules, which breaks the architectural boundary between tree nodes and visitors. Extract the merge logic into a standalone utility (merge-rules.js) that both AtRule.eval() and ToCSSVisitor can use without coupling. * fix: remove Container copy-paste duplication and fix evalNested splice index bug Container was overriding evalNested, permute, and bubbleSelectors with identical copies of the methods already provided by NestableAtRulePrototype. Remove the redundant overrides so Container properly inherits from the shared prototype. Also fix a bug in NestableAtRulePrototype.evalNested where context.mediaBlocks.splice(i, 1) used `i` (the index into `path`) to splice `mediaBlocks`. These are different arrays with different contents, so the index was wrong. Use indexOf(this) to find the correct position. * fix(benchmark): update scripts and results for v4.x compatibility - Fix percentage() calls in benchmark .less files for parens-division - Add --math=always passthrough to benchmark-runner.js - Handle all v3.12+/v4.x build scenarios in run-historical.sh (pnpm for workspace protocol, fallback tsc, separate runtime deps) - Use last patch of each minor version in historical suite - Update latest benchmark results (v2.0–v4.5.1) * perf: optimize hot paths and fix benchmark infrastructure (#4410) * fix(benchmark): fix division in benchmark files for v4 math defaults Wrap bare divisions inside percentage() calls in extra parens so benchmarks work with v4's default parens-division math mode. Add --math option passthrough to benchmark-runner.js and pass --math=always in run-historical.sh for consistent cross-version results. * perf: remove unnecessary closures in hot paths - Remove `extendVisitor` alias in findMatch, use `this` directly - Replace IIFE closure for functionRegistry lookup in Ruleset.eval with inline loop ~5% improvement on main benchmark (median 38.6ms → 37.1ms) * perf: replace forEach/map closures with for loops in hot paths - Selector.eval: replace map() closures with pre-allocated for loops - Ruleset transformDeclaration: replace forEach with for loop - extend-visitor visitRuleset: replace forEach with for loop, cache extend and pathCount to reduce repeated property access Combined with previous commit: ~8% improvement on 104KB benchmark (median 38.6ms → 36.4ms) * fix(benchmark): handle all v3.12+/v4.x build scenarios - Use pnpm for v4.3+ (workspace: protocol) - Fallback tsc installation when npm can't install locally - Install runtime deps separately when npm fails due to unpublished workspace packages (@less/test-import-module) - Use last patch version of each minor release - Skip v3.13.x (broken source: missing tree/util.js) * bench: update benchmark results after hot-path optimizations Median: 39.07ms → 34.32ms (~12% improvement) Throughput: 2,495 KB/s → 2,828 KB/s System: macbook-pro arm64 * bench: add historical benchmark results and track runs in git - Add historical benchmark data (v3.5–v4.2) to results/runs/ - Update latest/ with all versions including v4.5.0-dev optimized results - Format JSON with 2-space indentation - Update .gitignore to track runs/ (historical records belong in git) * bench: full historical benchmark run (v2.0–v4.5, 23 versions) Apple M4 Pro, arm64, Node v18/v20/v24 Key findings: - v2.4-v2.5 fastest era (~31ms median on 104KB file) - v3.10-v3.12 massive regression (3-5x slower, 126-185ms) - v4.0 recovered to ~40ms - v4.2 fastest v4.x (35.4ms) - v4.5.1 current master: 42.2ms * bench: prune version list to significant performance changes Reduced from 23 to 15 versions based on full benchmark data. Dropped versions with <5% difference from their predecessor: - v2.1 (broken), v2.5, v2.7 (plateau with v2.4/v2.6) - v3.6–v3.9 (all within 1ms, flat ~41ms) - v4.1 (identical to v4.0) The full set can still be run with --versions flag. * fix(benchmark): fix invalid CSS in benchmark.less and add Jess wrapper support - Fix invalid CSS patterns in benchmark.less: hex-color selectors (#808080), bare declarations in @media, :not(1), unquoted attr values, empty margin - Add benchmark-runner.cjs for CJS compatibility with ESM package - Add callback support to render() in lib/index.js alongside Promise return * feat: migrate to native ESM with no build step (#4411) * feat: migrate to native ESM with no build step - Rename src/ to lib/ — source files are shipped directly, no compilation - Add "type": "module" to package.json for native ESM support (Node 18+) - Convert bin/lessc, test files, and build scripts from CJS to ESM - Rename Gruntfile.js and .eslintrc.js to .cjs (must remain CommonJS) - Add .js extensions to all relative import paths for ESM resolution - Use createRequire() for optional dependency resolution (npm packages, JSON) - Configure TypeScript for check-only mode (noEmit: true, allowJs: true) - Update Rollup config to read from lib/ directly - Update CI matrix to drop Node 16 (minimum Node 18+) - Browser build is smaller: 500KB (was 509KB), minified 153KB (was 158KB) - All 139 tests pass * chore: fix trailing semicolons from linter * chore: gitignore generated .css.map files in lib/ * fix(ci): restore lts/-3 to test matrix * chore: stop tracking dist/ build artifacts Generated browser bundles don't need to be in source control — they're built during publish and included in the npm package via the files field. Removes duplicate copies from both root dist/ and packages/less/dist/. * fix(ci): use pnpm exec for playwright install npx doesn't reliably find binaries with pnpm. Since playwright is already a devDependency, use pnpm exec to run the installed version. * fix(ci): use pnpm --filter for playwright, disable fail-fast pnpm exec at workspace root can't find playwright binary since it's a devDependency of the less package. Use --filter to run in that context. Also disable fail-fast so all matrix jobs complete independently. * fix(ci): move playwright to root devDependencies Makes pnpm exec playwright work from workspace root in CI. * fix: upgrade copy-anything to v3 for ESM compat, fix Windows test paths copy-anything v2 lacks "type": "module", causing named import failures on Node 18. v3 has proper ESM exports. Revert testFolder to absolute path (matching original behavior) so debug test path replacements match Less compiler output on Windows. * chore: add CodeRabbit config to raise file review limit * fix: add files field to package.json, remove postinstall from published package Restricts npm package to only bin/, lib/, dist/, index.js, and README.md. Previously shipped test files, Gruntfile, eslint config, etc. Removes postinstall script (Playwright browser install) which only applies in the monorepo dev environment and fails when installed from npm. Verified: npm pack --dry-run shows 120 files (was 229), lessc CLI and API both work from a clean tarball install. * refactor: convert prototype-based tree nodes to ES6 classes (#4412) * refactor: convert prototype-based tree nodes to ES6 classes Convert all 30 tree node files from `Object.assign(new Node(), {...})` prototype pattern to proper `class extends Node` syntax. This enables TypeScript to understand the inheritance chain, reducing checkJs errors from 2756 to 0. - All tree nodes now use `class X extends Node` (or appropriate parent) - Node.type converted from instance property to getter for clean override - Factory functions in index.js updated to use `new` instead of Object.create + apply (required for ES6 class compatibility) - Benchmark script converted to ESM - Added @types/node devDependency for checkJs support - Enabled checkJs in tsconfig.json - Added JSDoc types to node.js base class and several utility files No behavioral changes - all 139 tests pass, benchmark performance unchanged vs historical baselines (avg 36-39ms for 104KB). * fix: @plugin deprecation says "replaced" not "removed" * fix: use constructor params for AtRule selectors, path.resolve in benchmark * fix: align @types/node with engines.node >=18 floor * feat: JSDoc type annotations for all tree node files (#4413) * feat: add JSDoc type annotations with @ts-check to all tree node files Add proper JSDoc type annotations to all 44 files in lib/less/tree/, enabling per-file TypeScript checking via @ts-check. No {*} or {any} casts — all types are derived from reading the actual code. Key changes: - Shared types (EvalContext, CSSOutput, TreeVisitor, FileInfo, VisibilityInfo) defined in node.js - Node.value typed as union: Node | Node[] | string | number | undefined - Node.prototype.parse declared for parser-injected prototype property - Constructor properties explicitly declared with proper types - Inline casts used to narrow union types at usage sites - Widened base class params where subclasses pass different types Also adds typecheck to prepublishOnly and pre-commit hook to catch regressions as more files are annotated toward global checkJs: true. All 139 tests pass, zero TypeScript errors. * fix: remove duplicate JSDoc type annotation in ruleset.js * fix: pre-existing bug fixes in tree nodes (#4414) * fix: preserve alpha 0 for fully transparent hex colors #0000 and #00000000 parsed alpha as 0 which was treated as falsy by the || operator, causing it to fall back to 1 (opaque). Use typeof check instead so alpha 0 is preserved. * fix: selector getElements callback `this` binding and forEach lint - Capture `this._fileInfo` and `this.parse.imports` into locals before the plain function callback in Selector.getElements(), where `this` is undefined in strict mode (ES modules) - Use explicit block in forEach to avoid implicit return of assignment * fix: preserve full error context when rethrowing mixin call errors The catch block in MixinCall.eval() only copied message and stack, dropping type, extract, callLine, and other LessError fields. This caused all mixin call errors to be reported as SyntaxError regardless of their actual type (e.g. NameError). Use spread to preserve all fields while still overriding index/filename to the call site. * fix: guard functionRegistry.inherit() and fix atrule parenting - Container and Media eval() now guard functionRegistry before calling .inherit(), matching mixin-definition.js defensive pattern - AtRule constructor: remove dead setParent(selectors) on orphaned local, parent this.declarations and this.rules with null checks * chore: release v4.6.0 (#4415) * chore: prepare v4.6.0 release - Bump version to 4.6.0 in all package.json files - Add CHANGELOG entry for v4.6.0 - Update publish workflow: replace deprecated actions/create-release with gh release create, attach dist files (less.js, less.min.js) as release assets, bump contents permission to write - Remove .github/** from paths-ignore (was preventing workflow updates) - Update CONTRIBUTING.md with detailed release documentation version: 4.6.0 * fix: publish workflow and provenance errors - Add repository field to test-data package.json (fixes npm OIDC provenance verification failure) - Skip publish workflow on forks (only run on less/less.js) - Remove duplicate require('fs') in bump-and-publish.js - Add language specifier to markdown code block in CONTRIBUTING.md * fix: handle existing releases for idempotent workflow re-runs * fix: CJS compatibility…

Initial plan

d44f1f1

Copilot AI assigned Copilot and matthew-dean Mar 17, 2026

Copilot started work on behalf of matthew-dean March 17, 2026 17:50 View session

fix: prevent npm publish when GitHub push fails, skip workflow on ver…

4c09402

…sion bump commits Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] [BUG-123] Fix npm package version not aligned with GitHub sources~~ fix: ensure npm publish is always backed by a GitHub tag and release Mar 17, 2026

Copilot AI requested a review from matthew-dean March 17, 2026 17:56

Copilot finished work on behalf of matthew-dean March 17, 2026 17:56

Copilot started work on behalf of matthew-dean March 17, 2026 19:23 View session

fix: skip version-bump commit entirely, push only the tag to bypass b…

8902b33

…ranch protection Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com>

Copilot finished work on behalf of matthew-dean March 17, 2026 19:30

Copilot started work on behalf of matthew-dean March 17, 2026 19:31 View session

Copilot finished work on behalf of matthew-dean March 17, 2026 19:33

matthew-dean marked this pull request as ready for review March 17, 2026 20:14

Copilot started work on behalf of matthew-dean March 17, 2026 20:14 View session

matthew-dean mentioned this pull request Mar 17, 2026

fix(less): upgrade make-dir to v4 to fix security vulnerability #4426

Merged

3 tasks

fix: restore version-bump commit + push to master, add infinite-loop …

f791453

…guard Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com>

Copilot AI changed the title ~~fix: ensure npm publish is always backed by a GitHub tag and release~~ fix: ensure npm publish is always backed by a GitHub tag, release, and version-bump commit Mar 17, 2026

Copilot finished work on behalf of matthew-dean March 17, 2026 20:19

Copilot started work on behalf of matthew-dean March 17, 2026 21:44 View session

fix: exclude .github and scripts from publish workflow trigger

b4beeab

Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com>

Copilot finished work on behalf of matthew-dean March 17, 2026 21:47

Copilot started work on behalf of matthew-dean March 17, 2026 21:52 View session

feat: implement PR-based release flow for master

ee04ec4

Co-authored-by: matthew-dean <414752+matthew-dean@users.noreply.github.com>

Copilot finished work on behalf of matthew-dean March 17, 2026 22:03

matthew-dean merged commit efd8b82 into master Mar 17, 2026
7 checks passed

matthew-dean requested a review from Copilot March 19, 2026 16:58

Copilot started reviewing on behalf of matthew-dean March 19, 2026 16:58 View session

Copilot AI reviewed Mar 19, 2026

View reviewed changes

Copilot AI mentioned this pull request Mar 19, 2026

feat: PR-based release flow for alpha; test suite proving all three release properties #4431

Merged

Uh oh!

Conversation

Copilot AI commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

How it works

Changes

Why this avoids branch-protection issues

Comments on the Issue (you are @copilot in this section)

Uh oh!

matthew-dean commented Mar 17, 2026

Uh oh!

matthew-dean commented Mar 17, 2026

Uh oh!

matthew-dean commented Mar 17, 2026

Uh oh!

Copilot AI commented Mar 17, 2026

Uh oh!

Copilot AI commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

matthew-dean commented Mar 17, 2026

Uh oh!

coderabbitai Bot commented Mar 17, 2026

Review skipped

Uh oh!

Copilot AI commented Mar 17, 2026

Uh oh!

matthew-dean commented Mar 17, 2026

Uh oh!

Copilot AI commented Mar 17, 2026

Uh oh!

matthew-dean commented Mar 17, 2026

Uh oh!

Copilot AI commented Mar 17, 2026

Uh oh!

Uh oh!

matthew-dean commented Mar 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

matthew-dean commented Mar 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 17, 2026 •

edited

Loading

Copilot AI commented Mar 17, 2026 •

edited

Loading