Skip to content

chore(deps-dev): bump the changelog group across 1 directory with 2 updates - #2669

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/changelog-70e8d40152
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/changelog-70e8d40152

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 25, 2026

Copy link
Copy Markdown
Contributor

Bumps the changelog group with 2 updates in the / directory: @changesets/changelog-github and @changesets/cli.

Updates @changesets/changelog-github from 0.7.0 to 1.0.1

Release notes

Sourced from @​changesets/changelog-github's releases.

@​changesets/changelog-github@​1.0.1

Patch Changes

  • Updated dependencies [4d7b4fb]:
    • @​changesets/get-github-info@​1.0.1

@​changesets/changelog-github@​1.0.0

Major Changes

Minor Changes

  • #2059 070f531 Thanks @​jycouet! - Add an opt-in, experimental template option to render changelog lines from tokens ({summary}, {ref}, {pull}, {commit}, {authors}). Default output is unchanged. The token syntax may change in a patch release; pin the version if you rely on it.

  • #1871 dfefc4e Thanks @​mihkeleidast! - Use GITHUB_REPOSITORY as the default repo when no repo option is configured

  • #1969 2c7c043 Thanks @​marcalexiei! - Add a named export that mirrors the current default export

    The default export is slated for removal in the next major release, so this ensures a smoother transition path.

Patch Changes

@​changesets/changelog-github@​1.0.0-next.9

Patch Changes

  • Updated dependencies [96b65ee]:
    • @​changesets/types@​7.0.0-next.9

@​changesets/changelog-github@​1.0.0-next.3

Major Changes

Minor Changes

  • #1969 2c7c043 Thanks @​marcalexiei! - Add a named export that mirrors the current default export

    The default export is slated for removal in the next major release, so this ensures a smoother transition path.

... (truncated)

Changelog

Sourced from @​changesets/changelog-github's changelog.

1.0.1

Patch Changes

  • Updated dependencies [4d7b4fb]:
    • @​changesets/get-github-info@​1.0.1

1.0.0

Major Changes

Minor Changes

  • #2059 070f531 Thanks @​jycouet! - Add an opt-in, experimental template option to render changelog lines from tokens ({summary}, {ref}, {pull}, {commit}, {authors}). Default output is unchanged. The token syntax may change in a patch release; pin the version if you rely on it.

  • #1871 dfefc4e Thanks @​mihkeleidast! - Use GITHUB_REPOSITORY as the default repo when no repo option is configured

  • #1969 2c7c043 Thanks @​marcalexiei! - Add a named export that mirrors the current default export

    The default export is slated for removal in the next major release, so this ensures a smoother transition path.

Patch Changes

1.0.0-next.9

Patch Changes

  • Updated dependencies [96b65ee]:
    • @​changesets/types@​7.0.0-next.9

1.0.0-next.8

Patch Changes

  • Updated dependencies [b5e1762]:
    • @​changesets/types@​7.0.0-next.8

... (truncated)

Commits

Updates @changesets/cli from 2.31.1 to 3.0.2

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​3.0.2

Patch Changes

@​changesets/cli@​3.0.1

Patch Changes

@​changesets/cli@​3.0.0

Major Changes

  • #2128 7113c01 Thanks @​Andarist! - Renamed the changeset tag command to changeset git-tag.

  • #2074 3599e47 Thanks @​bluwy! - Set supported package manager versions in "engines" field, including npm >=10.9.0, pnpm >=10.0.0, and yarn >=4.5.2.

  • #1860 92b1c1b Thanks @​mixelburg! - changeset version now exits with code 1 when there are no unreleased changesets, instead of silently exiting with code 0.

    This makes it easier to detect when a version step is a no-op — for example, to prevent accidentally publishing packages with incorrect version tags when using --snapshot mode.

  • #1482 df424a4 Thanks @​Andarist! - Bumped supported Node versions to ^22.11 || ^24 || >=26

  • #1994 062530b Thanks @​bluwy! - The prettier option in .changeset/config.json has been removed in favor of format. format supports "auto", "prettier", "oxfmt", "deno", and "dprint", and false disables formatting. If you previously used prettier: false, migrate to format: false or remove the option to use automatic formatter detection.

  • #2190 96b65ee Thanks @​bluwy! - Move versioned prerelease changesets to .changeset/pre/ folder instead of accumulating in the root and tracking the versioned changeset ids in the .changeset/pre.json file. Existing pre.json will auto-migrate to this new structure on the next run of changeset version or when calling changeset status.

    This change allows easier management of versioned prerelease changesets (for the final stable release) and current queued changesets (for the next prerelease). Changesets in .changeset/pre/ can be edited or deleted depending if it's still relevant for the final stable release of a package. There's no need to synchronize the changeset ids in pre.json if certain changesets are deleted.

  • #2145 f5887ff Thanks @​Andarist! - Removed Yarn Classic support

  • #2097 8c88f6a Thanks @​Andarist! - Packages with only prerelease versions published will now be published with the prerelease tag in the prerelease mode if the target registry doesn't auto-assign latest tag. npm registry itself does that and such packages will continue to be released with latest tag (and not with the configured prerelease tag).

  • #1879 c76b232 Thanks @​beeequeue! - Removed warning messages about using v1 configs. They will now be silently ignored.

  • #1655 db46911 Thanks @​bluwy! - Update @manypkg/get-packages which drops support for detecting packages in Bolt monorepos and adds support for npm monorepos

  • #1651 e1df862 Thanks @​bluwy! - Remove support for the --sinceMaster flag for changeset status. Use --since=master or --since=main instead.

  • #2117 813bbf3 Thanks @​bluwy! - Remove the pre.json initialVersions property and handling as it's unused internally

  • #1961 07278a7 Thanks @​beeequeue! - CommitFunctions can now be both sync and async, and the defaultCommitFunctions are now sync.

  • #1482 df424a4 Thanks @​Andarist! - From now on this package is going to be published as ES module.

... (truncated)

Changelog

Sourced from @​changesets/cli's changelog.

3.0.2

Patch Changes

3.0.1

Patch Changes

3.0.0

Major Changes

  • #2128 7113c01 Thanks @​Andarist! - Renamed the changeset tag command to changeset git-tag.

  • #2074 3599e47 Thanks @​bluwy! - Set supported package manager versions in "engines" field, including npm >=10.9.0, pnpm >=10.0.0, and yarn >=4.5.2.

  • #1860 92b1c1b Thanks @​mixelburg! - changeset version now exits with code 1 when there are no unreleased changesets, instead of silently exiting with code 0.

    This makes it easier to detect when a version step is a no-op — for example, to prevent accidentally publishing packages with incorrect version tags when using --snapshot mode.

  • #1482 df424a4 Thanks @​Andarist! - Bumped supported Node versions to ^22.11 || ^24 || >=26

  • #1994 062530b Thanks @​bluwy! - The prettier option in .changeset/config.json has been removed in favor of format. format supports "auto", "prettier", "oxfmt", "deno", and "dprint", and false disables formatting. If you previously used prettier: false, migrate to format: false or remove the option to use automatic formatter detection.

  • #2190 96b65ee Thanks @​bluwy! - Move versioned prerelease changesets to .changeset/pre/ folder instead of accumulating in the root and tracking the versioned changeset ids in the .changeset/pre.json file. Existing pre.json will auto-migrate to this new structure on the next run of changeset version or when calling changeset status.

    This change allows easier management of versioned prerelease changesets (for the final stable release) and current queued changesets (for the next prerelease). Changesets in .changeset/pre/ can be edited or deleted depending if it's still relevant for the final stable release of a package. There's no need to synchronize the changeset ids in pre.json if certain changesets are deleted.

  • #2145 f5887ff Thanks @​Andarist! - Removed Yarn Classic support

  • #2097 8c88f6a Thanks @​Andarist! - Packages with only prerelease versions published will now be published with the prerelease tag in the prerelease mode if the target registry doesn't auto-assign latest tag. npm registry itself does that and such packages will continue to be released with latest tag (and not with the configured prerelease tag).

  • #1879 c76b232 Thanks @​beeequeue! - Removed warning messages about using v1 configs. They will now be silently ignored.

  • #1655 db46911 Thanks @​bluwy! - Update @manypkg/get-packages which drops support for detecting packages in Bolt monorepos and adds support for npm monorepos

  • #1651 e1df862 Thanks @​bluwy! - Remove support for the --sinceMaster flag for changeset status. Use --since=master or --since=main instead.

  • #2117 813bbf3 Thanks @​bluwy! - Remove the pre.json initialVersions property and handling as it's unused internally

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 25, 2026
@vercel

vercel Bot commented Aug 25, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
frontends-starter-template-extended Ready Ready Preview Sep 9, 2026 3:09pm UTC
frontends-vue-starter-template Ready Ready Preview Sep 9, 2026 3:09pm UTC

Request Review

@dependabot dependabot Bot changed the title chore(deps-dev): bump the changelog group with 2 updates chore(deps-dev): bump the changelog group across 1 directory with 2 updates Aug 27, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/changelog-70e8d40152 branch from 01aa6f2 to 2928a80 Compare August 27, 2026 15:05
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/changelog-70e8d40152 branch from 2928a80 to 5b13c48 Compare August 31, 2026 15:06
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/changelog-70e8d40152 branch from 5b13c48 to 8282cd1 Compare August 31, 2026 15:45
@dependabot @github

dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/changelog-70e8d40152 branch from cc42fd4 to 4f30d99 Compare September 7, 2026 15:07
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/changelog-70e8d40152 branch from 4f30d99 to 13972b6 Compare September 7, 2026 19:54
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/changelog-70e8d40152 branch from 13972b6 to 1bf900d Compare September 7, 2026 20:20
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/changelog-70e8d40152 branch from 1bf900d to b8ba888 Compare September 8, 2026 15:06

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale comment

Security review

No medium, high, or critical vulnerabilities identified in this update.

This Dependabot PR only bumps devDependencies @changesets/changelog-github (0.7.01.0.1) and @changesets/cli (2.31.13.0.2), plus lockfile resolution. There is no application/runtime code change.

Checked:

  • No published GitHub Advisories for the targeted Changesets packages
  • New lockfile packages (@changesets/format, @manypkg/tools, jju, es-module-lexer, picomatch@4.0.7) are expected Changesets v3 / pnpm graph deps, not typosquats
  • Introduced picomatch@4.0.7 is past GHSA-3v7f-55p6-f55p / GHSA-c2c7-rcm5-vvqj (< 4.0.4)
  • Transitive churn (undici 6.28.1 / 7.29.1, h3 2.0.1-rc.31, srvx 1.0.3, terser 5.51.2) is at or above patched advisory ranges
  • Integrity hashes present; usage remains local/CI changelog and release tooling (.changeset/config.json already pins repo: shopware/frontends)

No inline findings.

Open in Web View Automation 

Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge

…pdates

Bumps the changelog group with 2 updates in the / directory: [@changesets/changelog-github](https://github.com/changesets/changesets/tree/HEAD/packages/changelog-github) and [@changesets/cli](https://github.com/changesets/changesets/tree/HEAD/packages/cli).


Updates `@changesets/changelog-github` from 0.7.0 to 1.0.1
- [Release notes](https://github.com/changesets/changesets/releases)
- [Changelog](https://github.com/changesets/changesets/blob/main/packages/changelog-github/CHANGELOG.md)
- [Commits](https://github.com/changesets/changesets/commits/@changesets/changelog-github@1.0.1/packages/changelog-github)

Updates `@changesets/cli` from 2.31.1 to 3.0.2
- [Release notes](https://github.com/changesets/changesets/releases)
- [Changelog](https://github.com/changesets/changesets/blob/main/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/changesets/changesets/commits/@changesets/cli@3.0.2/packages/cli)

---
updated-dependencies:
- dependency-name: "@changesets/changelog-github"
  dependency-version: 1.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: changelog
- dependency-name: "@changesets/cli"
  dependency-version: 3.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: changelog
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/changelog-70e8d40152 branch from b8ba888 to 23acd9b Compare September 9, 2026 15:05

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security review

No medium, high, or critical vulnerabilities identified.

This Dependabot recreate still only bumps root devDependencies @changesets/changelog-github (0.7.01.0.1) and @changesets/cli (2.31.13.0.2), plus lockfile resolution. There is no application or runtime code change.

Checked on 23acd9bb:

  • No published GitHub Advisories for the targeted Changesets packages
  • npm dist.integrity matches the lockfile for both direct deps
  • Introduced Changesets v3 graph (@changesets/format, picomatch@4.0.7, launch-editor@2.14.1, yaml@2.9.0) is at or above patched advisory ranges
  • Usage remains local/CI changelog and release tooling; .changeset/config.json already pins repo: shopware/frontends

No prior unresolved automation finding threads. No inline findings.

Open in Web View Automation 

Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge

@dependabot @github

dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 10, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/changelog-70e8d40152 branch September 10, 2026 13:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants