You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Supersedes the Dependabot-only bumps in #2639 (changesets/action v1 → v2) and #2669 (@changesets/cli 2.31.1 → 3.0.2, @changesets/changelog-github 0.7.0 → 1.0.1). Those PRs did not apply the v3/v2 breaking-change adjustments; #2643 started that work and was closed by Dependabot before it landed.
changesets/actionv2.1.2 (pinned SHA), with the renamed inputs (version-script, publish-script, commit-message, pr-title) and github-token instead of the GITHUB_TOKEN env var
.changeset/config.json: schema @changesets/config@4, format: "oxfmt", and privatePackages: { version: true, tag: false } to keep the v2 default (version docs, tsconfig, and templates/*, do not git-tag them)
Canary job skips entirely when .changeset/ has no pending markdown files, because changeset version now exits 1 when there is nothing to release
scripts/generateDependencyChangelog.ts updated for the ESM packages: named writeChangeset, manypkg v3 relativeDir/rootDir, and node:child_process instead of the removed spawndamnit transitive
Follow-up commit: pnpm overrides so pnpm audit stays green. The Audit check runs on any pnpm-lock.yaml change; the advisories (astro, sharp, vitest 4.1.10, @tiptap/core 3.30.4, js-yaml, svgo, smol-toml) were already in the tree.
Flows still working
Verified locally against the current pending changesets:
Flow
Result
changeset status
Same plan as today: minor api-client / nuxt-module, patch internal dependents
changeset add --patch <pkg> -m …
Non-interactive add works (clack prompts replace enquirer)
changeset version --snapshot canary
Still 0.0.0-canary-<UTC-timestamp>; only packages with pending changesets (plus dependents)
Empty .changeset/ + changeset version
Exits 1 (this is why canary is gated)
Private package with a changeset
docs, vue-starter-template, lumora-demo-store still appear in the release plan
changeset publish --no-git-tag
Still maps to gitTag: false
generateDependencyChangelog
Runs; no false positives on this branch
pnpm audit
Clean after the override pins
pnpm run version / changelog-github still need a GitHub token locally (same as v2). CI already passes CHANGESETS_TOKEN into the canary version step and github-token into the action (which sets GITHUB_TOKEN for the version script).
What could still break
These are the remaining risks after the adjustments — not blockers for merging, but worth knowing:
First canary/release on main is the real integration test. PR CI never runs .github/workflows/release.yml (push: main only). The local checks above cover the CLI; they cannot publish or open the version PR.
Version commits are pushed via the GitHub API (action v2 default), signed as github-actions[bot]. Same GITHUB_TOKEN as before, so follow-up workflows still will not retrigger. If anything required git-CLI committer identity, set push-with-git-cli: true.
Trusted publishing is unchanged (id-token: write, no NPM_TOKEN). Action v2 dropped .npmrc/NPM_TOKEN handling, which we already did not use. The action README now recommends splitting into /version + /publish sub-actions for tighter permissions; that is optional follow-up, not required for this upgrade.
Contributor UX:pnpm changeset prompts look slightly different (clack). Cancellation no longer crashes. Extra flags --patch/--minor/--major/-m work if we want non-interactive adds later.
Peer dependency bumps are now patch, not major. No published package currently declares peerDependencies, so this is a no-op until someone adds one.
Adjust the release workflow and changeset config for the v3 CLI
breaking changes, so canary and private-package versioning keep
working after the Dependabot bumps.
The Audit check runs on any pnpm-lock.yaml change. These advisories
were already in the tree; bump the existing overrides so pnpm audit
passes after the changesets upgrade.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review
No medium, high, or critical vulnerabilities in this update.
Reviewed the Changesets CLI v3 / action v2.1.2 upgrade, the canary pending-changeset gate, generateDependencyChangelog (spawn → execFile), and the audit override pins.
changesets/action@ae32849 peels to the official v2.1.2 tag. Moving GITHUB_TOKEN to the github-token input matches action v2; the workflow still runs only on push to main.
The canary find step writes static GITHUB_OUTPUT values (no injection).
Lockfile integrity hashes match npm for @changesets/cli@3.0.2, @changesets/changelog-github@1.0.1, and the override pins (js-yaml@4.3.2, svgo@4.1.0, smol-toml@1.7.1, sharp@0.35.4, astro@7.2.8, vitest / @vitest/mocker@4.1.11). Those overrides patch known advisories; they do not add a new reachable sink.
No prior security-review threads on this PR.
Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge
The reason will be displayed to describe this comment to others. Learn more.
Security review
No medium, high, or critical vulnerabilities in this update.
Re-reviewed on ready_for_review at the same head (c1286c8) as the prior assessment. Scope is the Changesets CLI v3 / action v2.1.2 upgrade, the canary pending-changeset gate, generateDependencyChangelog (spawn → execFile), and the audit override pins.
changesets/action@ae32849 peels to the official v2.1.2 tag. Moving GITHUB_TOKEN to the github-token input matches action v2; the workflow still runs only on push to main.
The canary find step writes static GITHUB_OUTPUT values (no injection).
Lockfile integrity hashes match npm for @changesets/cli@3.0.2, @changesets/changelog-github@1.0.1, and the override pins (js-yaml@4.3.2, svgo@4.1.0, smol-toml@1.7.1, sharp@0.35.4, astro@7.2.8, vitest / @vitest/mocker@4.1.11). Those overrides patch known advisories; they do not add a new reachable sink.
No prior security-review finding threads on this PR.
Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Cursor
Supersedes the Dependabot-only bumps in #2639 (
changesets/actionv1 → v2) and #2669 (@changesets/cli2.31.1 → 3.0.2,@changesets/changelog-github0.7.0 → 1.0.1). Those PRs did not apply the v3/v2 breaking-change adjustments; #2643 started that work and was closed by Dependabot before it landed.What changed
@changesets/cli3.0.2,@changesets/changelog-github1.0.1changesets/actionv2.1.2 (pinned SHA), with the renamed inputs (version-script,publish-script,commit-message,pr-title) andgithub-tokeninstead of theGITHUB_TOKENenv var.changeset/config.json: schema@changesets/config@4,format: "oxfmt", andprivatePackages: { version: true, tag: false }to keep the v2 default (versiondocs,tsconfig, andtemplates/*, do not git-tag them).changeset/has no pending markdown files, becausechangeset versionnow exits 1 when there is nothing to releasescripts/generateDependencyChangelog.tsupdated for the ESM packages: namedwriteChangeset, manypkg v3relativeDir/rootDir, andnode:child_processinstead of the removedspawndamnittransitivepnpm auditstays green. The Audit check runs on anypnpm-lock.yamlchange; the advisories (astro, sharp, vitest 4.1.10,@tiptap/core3.30.4, js-yaml, svgo, smol-toml) were already in the tree.Flows still working
Verified locally against the current pending changesets:
changeset statusapi-client/nuxt-module, patch internal dependentschangeset add --patch <pkg> -m …changeset version --snapshot canary0.0.0-canary-<UTC-timestamp>; only packages with pending changesets (plus dependents).changeset/+changeset versiondocs,vue-starter-template,lumora-demo-storestill appear in the release planchangeset publish --no-git-taggitTag: falsegenerateDependencyChangelogpnpm auditpnpm run version/ changelog-github still need a GitHub token locally (same as v2). CI already passesCHANGESETS_TOKENinto the canary version step andgithub-tokeninto the action (which setsGITHUB_TOKENfor the version script).What could still break
These are the remaining risks after the adjustments — not blockers for merging, but worth knowing:
mainis the real integration test. PR CI never runs.github/workflows/release.yml(push: mainonly). The local checks above cover the CLI; they cannot publish or open the version PR.github-actions[bot]. SameGITHUB_TOKENas before, so follow-up workflows still will not retrigger. If anything required git-CLI committer identity, setpush-with-git-cli: true.id-token: write, noNPM_TOKEN). Action v2 dropped.npmrc/NPM_TOKENhandling, which we already did not use. The action README now recommends splitting into/version+/publishsub-actions for tighter permissions; that is optional follow-up, not required for this upgrade.pnpm changesetprompts look slightly different (clack). Cancellation no longer crashes. Extra flags--patch/--minor/--major/-mwork if we want non-interactive adds later.patch, notmajor. No published package currently declarespeerDependencies, so this is a no-op until someone adds one.chore: next version release) will be regenerated by the next push tomainafter this merges; that is expected.No changeset file: this is tooling/CI only.