@grafana/create-plugin 7.7.0-canary.2656.26454058960.0 → 7.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,27 @@
|
|
|
1
|
+
# v7.7.0 (Fri May 29 2026)
|
|
2
|
+
|
|
3
|
+
#### 🚀 Enhancement
|
|
4
|
+
|
|
5
|
+
- feat: replace insecure sign script [#2656](https://github.com/grafana/plugin-tools/pull/2656) ([@jackw](https://github.com/jackw))
|
|
6
|
+
|
|
7
|
+
#### Authors: 1
|
|
8
|
+
|
|
9
|
+
- Jack Westbrook ([@jackw](https://github.com/jackw))
|
|
10
|
+
|
|
11
|
+
---
|
|
12
|
+
|
|
13
|
+
# v7.6.2 (Wed May 27 2026)
|
|
14
|
+
|
|
15
|
+
#### 🐛 Bug Fix
|
|
16
|
+
|
|
17
|
+
- fix: pin dependencies for better security [#2658](https://github.com/grafana/plugin-tools/pull/2658) ([@jackw](https://github.com/jackw))
|
|
18
|
+
|
|
19
|
+
#### Authors: 1
|
|
20
|
+
|
|
21
|
+
- Jack Westbrook ([@jackw](https://github.com/jackw))
|
|
22
|
+
|
|
23
|
+
---
|
|
24
|
+
|
|
1
25
|
# v7.6.1 (Tue May 26 2026)
|
|
2
26
|
|
|
3
27
|
#### 🐛 Bug Fix
|
|
@@ -63,7 +63,7 @@ var defaultMigrations = [
|
|
|
63
63
|
},
|
|
64
64
|
{
|
|
65
65
|
name: "011-secure-sign-script",
|
|
66
|
-
version: "7.6.
|
|
66
|
+
version: "7.6.3",
|
|
67
67
|
description: "Security: replace insecure inline `npx --yes @grafana/sign-plugin@latest` sign script with a locked @grafana/sign-plugin devDependency to prevent arbitrary code execution from a compromised @latest publish.",
|
|
68
68
|
scriptPath: import.meta.resolve("./scripts/011-secure-sign-script.js")
|
|
69
69
|
}
|
package/package.json
CHANGED
|
@@ -1,7 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@grafana/create-plugin",
|
|
3
|
-
"version": "7.7.0
|
|
3
|
+
"version": "7.7.0",
|
|
4
4
|
"repository": {
|
|
5
|
+
"type": "git",
|
|
5
6
|
"directory": "packages/create-plugin",
|
|
6
7
|
"url": "https://github.com/grafana/plugin-tools"
|
|
7
8
|
},
|
|
@@ -25,35 +26,35 @@
|
|
|
25
26
|
"typecheck": "tsc --noEmit"
|
|
26
27
|
},
|
|
27
28
|
"dependencies": {
|
|
28
|
-
"@babel/parser": "
|
|
29
|
-
"@ivanmaxlogiudice/gitignore": "
|
|
30
|
-
"change-case": "
|
|
31
|
-
"debug": "
|
|
32
|
-
"enquirer": "
|
|
33
|
-
"find-up": "
|
|
34
|
-
"glob": "
|
|
35
|
-
"handlebars": "
|
|
36
|
-
"jsonc-parser": "
|
|
37
|
-
"minimist": "
|
|
38
|
-
"recast": "
|
|
39
|
-
"semver": "
|
|
40
|
-
"title-case": "
|
|
41
|
-
"valibot": "
|
|
42
|
-
"which": "
|
|
43
|
-
"yaml": "
|
|
29
|
+
"@babel/parser": "7.29.0",
|
|
30
|
+
"@ivanmaxlogiudice/gitignore": "0.0.2",
|
|
31
|
+
"change-case": "5.4.4",
|
|
32
|
+
"debug": "4.4.3",
|
|
33
|
+
"enquirer": "2.4.1",
|
|
34
|
+
"find-up": "8.0.0",
|
|
35
|
+
"glob": "13.0.6",
|
|
36
|
+
"handlebars": "4.7.9",
|
|
37
|
+
"jsonc-parser": "3.3.1",
|
|
38
|
+
"minimist": "1.2.8",
|
|
39
|
+
"recast": "0.23.11",
|
|
40
|
+
"semver": "7.7.2",
|
|
41
|
+
"title-case": "4.3.2",
|
|
42
|
+
"valibot": "1.2.0",
|
|
43
|
+
"which": "6.0.1",
|
|
44
|
+
"yaml": "2.9.0"
|
|
44
45
|
},
|
|
45
46
|
"devDependencies": {
|
|
46
|
-
"@libs/output": "
|
|
47
|
-
"@libs/version": "
|
|
48
|
-
"@types/glob": "
|
|
49
|
-
"@types/minimist": "
|
|
50
|
-
"@types/semver": "
|
|
51
|
-
"@types/tmp": "
|
|
52
|
-
"@types/which": "
|
|
53
|
-
"tmp": "
|
|
47
|
+
"@libs/output": "1.0.3",
|
|
48
|
+
"@libs/version": "1.0.2",
|
|
49
|
+
"@types/glob": "9.0.0",
|
|
50
|
+
"@types/minimist": "1.2.5",
|
|
51
|
+
"@types/semver": "7.7.1",
|
|
52
|
+
"@types/tmp": "0.2.6",
|
|
53
|
+
"@types/which": "3.0.4",
|
|
54
|
+
"tmp": "0.2.5"
|
|
54
55
|
},
|
|
55
56
|
"engines": {
|
|
56
57
|
"node": ">=20"
|
|
57
58
|
},
|
|
58
|
-
"gitHead": "
|
|
59
|
+
"gitHead": "57e7611bcbbd068694bda70df57fa86008dd3353"
|
|
59
60
|
}
|
|
@@ -73,7 +73,7 @@ export default [
|
|
|
73
73
|
},
|
|
74
74
|
{
|
|
75
75
|
name: '011-secure-sign-script',
|
|
76
|
-
version: '7.6.
|
|
76
|
+
version: '7.6.3',
|
|
77
77
|
description:
|
|
78
78
|
'Security: replace insecure inline `npx --yes @grafana/sign-plugin@latest` sign script with a locked @grafana/sign-plugin devDependency to prevent arbitrary code execution from a compromised @latest publish.',
|
|
79
79
|
scriptPath: import.meta.resolve('./scripts/011-secure-sign-script.js'),
|