chore: release cli 0.10.56 - #1420
Merged
Merged
Conversation
Ships the scaffold audit fix from #1419, so that `npm create webjs` stops emitting apps that report 5 high-severity advisories on their first install. The fix only reaches users through a published `@webjsdev/cli`, since `create-webjs` resolves it from the registry. The changelog is hand-written rather than generated. The generator matches conventional subjects in the package tree, and the unreleased log for `@webjsdev/cli` also carries the `feat:` subject from #1414, whose work was fully reverted by #1417. That revert landed with a `revert:` prefix the generator does not match, so an auto-generated entry would have advertised a feature that is not in the code.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Releases
@webjsdev/cli0.10.56, carrying the scaffold audit fix from #1419.Why this needs a release at all
The fix is in
lib/create.js, which ships inside the published@webjsdev/clitarball, andcreate-webjsdepends on@webjsdev/cli: ^0.10.0resolved from the registry. npm currently serves 0.10.55, the version without the override, so until this publishes,npm create webjs@latestkeeps emitting apps that report 5 high-severity advisories on their first install. Merging #1419 changed nothing for anyone outside this repo.Scope
@webjsdev/clionly.core,server, anduireleased in #1415 and carry no unreleased qualifying commits, andmcpandintellisenseare current. A patch bump keepscliinside the^0.10.0range thatexamples/blog,website,gallery,create-webjs, andwebjsdevall pin, so no dependent range moves. The two lockstep wrappers are deliberately left alone; the release workflow owns their versions.The changelog is hand-written on purpose
scripts/backfill-changelog.jsmatches^(feat|fix|breaking|perf)subjects in the package's tree. The unreleased log for@webjsdev/cliholds two matching commits, not one:818c27b2fix(cli): the audit fix, which belongs in this release09f81345feat: make the UI kit and AI design guidance first class (feat: make the UI kit and AI design guidance first class #1414)The second was fully reverted by
948d8555(#1417), but that revert landed with arevert:prefix the generator does not match, so nothing cancels the original. An auto-generated changelog would therefore have advertised a feature that is not in the code.changelog/cli/0.10.56.mdis written by hand to carry the fix alone, and the pre-commit hook skips generation when the file already exists.Worth noting separately, since it outlives this PR: any future release of a package whose tree holds a reverted
feat:will hit the same gap. The generator has no revert awareness at all.Test plan
git diff package-lock.json^0.10.0, which 0.10.56 satisfies, so no range edits are needed@webjsdev/intellisenseis not part of this bump, so the webjs.nvim vendor re-sync that a manifest change would require does not applyOn merge
Adding
changelog/cli/0.10.56.mdtomaintriggersrelease.ymltonpm publishand cut the GitHub Release. That step is idempotent.