@hyperfrontend/versioning 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.3.0](https://github.com/AndrewRedican/hyperfrontend/compare/31943a4b39484dba86b358e4f361abe76edc4fe1...2737bb00792930010cd0161b87b4ca80b2c155e0) - 2026-03-21
+
+### Features
+
+- add commit type to section config option
+- add changelog file name config option
+- export key configuration constants
+- make project prefixes configurable
+- add max commit fallback config option
+
+### Bug Fixes
+
+- **eslint-rules:** validate github urls via url parsing
+
 ## [0.2.0](https://github.com/AndrewRedican/hyperfrontend/compare/a9185d9b783d7d8d51cc4ad91eb3178eba3e3930...bdcdfe00e5c9680e7a1eb925ef69997601d0f393) - 2026-03-20
 
 ### Features

package/README.md

@@ -34,6 +34,7 @@
 Versioning library with changelog parsing, conventional commits, and semver flow orchestration.
 
 • 👉 See [**documentation**](https://www.hyperfrontend.dev/docs/libraries/versioning/)
+• 👉 See [**roadmap**](https://github.com/AndrewRedican/hyperfrontend/blob/main/roadmap/versioning/)
 
 ## What is @hyperfrontend/versioning?
 
@@ -42,10 +43,10 @@ Versioning library with changelog parsing, conventional commits, and semver flow
 ### Key Features
 
 - **Changelog Parsing** - Parse CHANGELOG.md files into structured objects with lossless round-tripping
-- **Conventional Commits** - Parse commit messages following the conventional commits specification
-- **Semver Utilities** - Parse, compare, increment, and validate semantic versions
-- **Registry Client** - Query npm registry for published versions and package metadata
-- **Compare URLs** - Generate platform-specific compare URLs for changelog entries (GitHub, GitLab, Bitbucket, Azure DevOps)
+- **Conventional Commits** - Parse commit messages following the [Conventional Commits](https://www.conventionalcommits.org/) specification
+- **Semver Utilities** - Parse, compare, increment, and validate [semantic versions](https://semver.org/)
+- **Registry Client** - Query [npm](https://www.npmjs.com/) registry for published versions and package metadata
+- **Compare URLs** - Generate platform-specific compare URLs for changelog entries ([GitHub](https://github.com/), [GitLab](https://about.gitlab.com/), [Bitbucket](https://bitbucket.org/), [Azure DevOps](https://azure.microsoft.com/en-us/products/devops))
 - **Monorepo Scope Filtering** - Intelligent commit classification ensures changelogs only include relevant commits
 - **Composable Operations** - Build complex versioning workflows from simple, pure functions
 - **Zero External Dependencies** - Self-contained implementation with no third-party runtime dependencies
@@ -64,7 +65,7 @@ Working with CHANGELOG.md files programmatically typically involves fragile stri
 
 ### Unified Versioning Primitives
 
-Version management requires coordinating semver parsing, commit analysis, changelog generation, and registry queries. This library provides all these primitives in one cohesive package with consistent APIs. Query npm for published versions, parse commit history, calculate version bumps, and generate changelog entries — all composable into custom release workflows.
+Version management requires coordinating [semver](https://semver.org/) parsing, commit analysis, changelog generation, and registry queries. This library provides all these primitives in one cohesive package with consistent APIs. Query [npm](https://www.npmjs.com/) for published versions, parse commit history, calculate version bumps, and generate changelog entries — all composable into custom release workflows.
 
 ### Zero-Dependency CI Integration
 
@@ -97,7 +98,8 @@ for (const entry of changelog.entries) {
 }
 
 // Access metadata
-console.log(changelog.metadata.format) // 'keep-a-changelog', 'conventional', etc.
+// Formats: 'keep-a-changelog' (https://keepachangelog.com), 'conventional', etc.
+console.log(changelog.metadata.format)
 ```
 
 ### Parsing Conventional Commits

package/changelog/index.cjs.js

@@ -2842,11 +2842,22 @@ function isWhitespace$1(char) {
 }
 
 /**
- * Changelog Parser
+ * Validates that a URL is actually a GitHub URL by parsing it properly.
+ * This prevents SSRF attacks where 'github.com' could appear in path/query.
  *
- * Parses a changelog markdown string into a structured Changelog object.
- * Uses a state machine tokenizer for ReDoS-safe parsing.
+ * @param url - The URL string to validate
+ * @returns True if the URL host is github.com or a subdomain
  */
+function isGitHubUrl(url) {
+    try {
+        const parsed = createURL(url);
+        // Check that the host is exactly github.com or ends with .github.com
+        return parsed.host === 'github.com' || parsed.host.endsWith('.github.com');
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Parses a changelog markdown string into a Changelog object.
  *
@@ -2914,7 +2925,7 @@ function parseHeader(state) {
                 description.push(`[${token.value}](${nextToken.value})`);
                 links.push({ label: token.value, url: nextToken.value });
                 // Try to detect repository URL
-                if (!state.repositoryUrl && nextToken.value.includes('github.com')) {
+                if (!state.repositoryUrl && isGitHubUrl(nextToken.value)) {
                     state.repositoryUrl = extractRepoUrl(nextToken.value);
                 }
                 advance(state); // skip link-text