@mui/internal-code-infra 0.1.1-canary.2 → 0.1.1-canary.21

package/README.md

@@ -14,9 +14,9 @@ This is stored in the `docs` top-level directory.
 
 1. Go to the publish action -
 
-- [Base UI](https://github.com/mui/base-ui/actions/workflows/publish.yml)
+- [Base UI](https://github.com/mui/base-ui/actions/workflows/publish.yml)
 - [Core](https://github.com/mui/material-ui/actions/workflows/publish.yml)
-- [MUI X](https://github.com/mui/mui-x/actions/workflows/publish.yml)
+- [MUI X](https://github.com/mui/mui-x/actions/workflows/publish.yml)
 
 2. Choose "Run workflow" dropdown
 
@@ -24,12 +24,15 @@ This is stored in the `docs` top-level directory.
    > - **Commit SHA to release from:** the commit that contains the merged release on master. This commit is linked to the GitHub release.
    > - **Run in dry-run mode:** Used for debugging.
    > - **Create GitHub release:** Keep selected if you want a GitHub release to be automatically created from the changelog.
-   > - **npm dist tag to publish to** Use to publish legacy or canary versions.
+   > - **npm dist tag to publish to** Use to publish legacy or canary versions. The publish fails before it publishes anything when a dist-tag would move to a lower version. `latest` and `latest-*` also cannot move to a prerelease unless they already point to one, and `latest-*` cannot change its major.
 
 3. Click "Run workflow"
 4. Refresh the page to see the newly created workflow, and click it.
 5. The next screen shows "@username requested your review to deploy to npm-publish", click "Review deployments" and authorize your workflow run. **Never approve workflow runs you didn't initiaite.**
 
+> [!NOTE]
+> A CI dry run (`code-infra publish --ci --dry-run`) runs the same dist-tag check. On a branch that does not publish to `latest`, pass the dist-tag of the release to it, for example `--tag next` for prereleases or `--tag latest-v8` for a previous major.
+
 > [!IMPORTANT]
 > Go through the below steps if there is an error that says `The following packages are new and need to be published manually first` in the publish flow.
 
@@ -59,7 +62,7 @@ If publishing fails with npm asking for `otp`, run the command again with 6 digi
 pnpm code-infra publish-new-package --otp=123456
 ```
 
-3. Go to the settings link for each package, e.g., `https://www.npmjs.com/package/<pkg-name>/access`, and setup `Trusted Publisher`.
+3. Go to the settings link for each package, for example, `https://www.npmjs.com/package/<pkg-name>/access`, and setup `Trusted Publisher`.
 4. In the `Select your publisher` step in the above link, click on the `GitHub Actions` button to configure GitHub Actions-based trusted publishing.
 5. Fill in the details of the repo -
    1. `Organization or user` as `mui`,

package/build/changelog/fetchChangelogs.d.mts

@@ -8,6 +8,14 @@ export type FetchCommitsOptions = {
      * - GitHub organization name, defaults to 'mui'
      */
     org?: string;
+    /**
+     * - Called as commits are listed and their pull request details are fetched
+     */
+    onProgress?: (progress: {
+        phase: string;
+        count: number;
+        total: number;
+    }) => void;
 };
 /**
  * @typedef {import('@octokit/rest').Octokit} OctokitType
@@ -21,17 +29,8 @@ export type FetchCommitsOptions = {
  * @property {string} lastRelease
  * @property {string} release
  * @property {string} [org='mui'] - GitHub organization name, defaults to 'mui'
+ * @property {(progress: { phase: string; count: number; total: number }) => void} [onProgress] - Called as commits are listed and their pull request details are fetched
  */
-/**
- * @param {Object} opts
- * @param {string} opts.cwd
- * @param {boolean} [opts.fetchAll=true] Whether to fetch all tags from all remotes before finding the latest tag.
- * @returns {Promise<string>}
- */
-export declare function findLatestTaggedVersion(opts: {
-    cwd: string;
-    fetchAll?: boolean;
-}): Promise<string>;
 /**
  * Fetches commits between two refs (lastRelease..release) including PR details.
  * Automatically handles GitHub OAuth authentication if none provided.

package/build/changelog/index.d.mts

@@ -4,3 +4,4 @@
 export { generateChangelog } from './generateChangelog.mjs';
 export * from './loadChangelogConfig.mjs';
 export * from './fetchChangelogs.mjs';
+export { findLatestTaggedVersion } from '../utils/git.mjs';

package/build/cli/cmdBaseline.d.mts

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+export type Args = {
+    /**
+     * - Branch pull requests fork from
+     */
+    baseBranch?: string;
+    /**
+     * - Remote the base branch is fetched from
+     */
+    remote?: string;
+};
+/**
+ * @typedef {Object} Args
+ * @property {string} [baseBranch] - Branch pull requests fork from
+ * @property {string} [remote] - Remote the base branch is fetched from
+ */
+declare const _default: import('yargs').CommandModule<{}, Args>;
+export default _default;

package/build/cli/cmdNetlifyIgnore.d.mts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 export type Args = {
     /**
-     * - List of workspace names to process
+     * - Workspace names or root-relative paths to process
      */
     workspaces: string[];
     /**

package/build/eslint/mui/rules/no-constructor-assigned-field.d.mts

@@ -0,0 +1,50 @@
+import { ESLintUtils } from '@typescript-eslint/utils';
+export type PropertyDefinition = import('@typescript-eslint/utils').TSESTree.PropertyDefinition;
+export type Node = import('@typescript-eslint/utils').TSESTree.Node;
+/**
+ * ESLint rule that disallows assigning a class field in the constructor when it is also
+ * declared as a (non-`declare`) class field.
+ *
+ * Babel 8 only strips TypeScript fields marked `declare` (see mui/material-ui#49241), so a
+ * field without an initializer is emitted as a property definition that sets it to
+ * `undefined` before the constructor assigns it again. Either initialize the field at its
+ * declaration, or mark it `declare` so it only serves as a type annotation.
+ *
+ * `declare` fields are exempt from TypeScript's strict property initialization check
+ * (TS2564), so prefer initializing at the declaration where the value doesn't depend on
+ * constructor arguments. The `declare` suggestion is only offered when every path through the
+ * constructor assigns the field, i.e. for an unconditional top-level assignment.
+ *
+ * Only plain `=` assignments count: compound assignments read the field rather than
+ * re-initialize it. A field with an initializer is only reported for an unconditional
+ * top-level assignment, as a conditional one overrides a default. Private (`#`) and decorated
+ * fields are ignored: they are runtime declarations that `declare` can't replace.
+ *
+ * @example
+ * // Invalid
+ * class ModalManager {
+ *   private modals: Modal[];
+ *   constructor() {
+ *     this.modals = [];
+ *   }
+ * }
+ *
+ * @example
+ * // Valid - initialized at the declaration
+ * class ModalManager {
+ *   private modals: Modal[] = [];
+ * }
+ *
+ * @example
+ * // Valid - declared only, assigned in the constructor
+ * class ModalManager {
+ *   declare private modals: Modal[];
+ *   constructor(modals: Modal[]) {
+ *     this.modals = modals;
+ *   }
+ * }
+ */
+declare const _default: ESLintUtils.RuleModule<"addDeclare" | "assignedInConstructor", [], unknown, ESLintUtils.RuleListener> & {
+    name: string;
+};
+export default _default;

package/build/eslint/packageJsonConfig.d.mts

@@ -0,0 +1,7 @@
+/**
+ * Lints package.json files for publishing metadata. Published packages must
+ * declare an SPDX license, `"author": "MUI Team"` and a repository pointing at
+ * their own directory. Private packages must not carry publishing metadata.
+ * @returns {import('eslint').Linter.Config[]}
+ */
+export declare function createPackageJsonConfig(): import('eslint').Linter.Config[];

package/build/remark/config.d.mts

@@ -1,5 +1,3 @@
-import remarkGfm from 'remark-gfm';
-import remarkLint from 'remark-lint';
 /**
  * Returns a remark preset wiring the MUI-authored remark-lint plugins together
  * with a curated set of community plugins. Drop this into `.remarkrc.mjs`:
@@ -23,21 +21,14 @@ import remarkLint from 'remark-lint';
  * ```
  *
  * @param {Object} [options]
+ * @param {boolean} [options.allowDefinitionComments=false] Allow titled `[//]` link-reference comments.
  * @param {Array<{ files: string | string[], rules: Record<string, false | unknown[]> }>} [options.overrides]
+ * @returns {import('unified').Preset}
  */
-export declare function createRemarkConfig({ overrides }?: {
+export declare function createRemarkConfig({ overrides, allowDefinitionComments }?: {
+    allowDefinitionComments?: boolean;
     overrides?: Array<{
         files: string | string[];
         rules: Record<string, false | unknown[]>;
     }>;
-}): {
-    settings: {
-        bullet: string;
-        emphasis: string;
-        fence: string;
-        listItemIndent: string;
-        resourceLink: boolean;
-        rule: string;
-    };
-    plugins: (any[] | typeof remarkGfm | typeof remarkLint)[];
-};
+}): import('unified').Preset;

package/build/utils/build.d.mts

@@ -93,6 +93,20 @@ export declare function validatePkgJson(packageJson: Record<string, any>, option
     skipMainCheck?: boolean;
     enableReactCompiler?: boolean;
 }): void;
+/**
+ * Validates that "engines.node" in package.json doesn't allow Node.js versions older than the
+ * "node" browserslist environment, which the CommonJS bundle is compiled for. Otherwise the
+ * build can emit syntax that the oldest supported Node.js version can't run.
+ * Targets are resolved the same way `@babel/preset-env` resolves them during the build.
+ * @param {{ name?: string; engines?: { node?: string } }} packageJson
+ * @param {string} cwd - The package directory, used to find the browserslist config.
+ */
+export declare function validateEnginesNode(packageJson: {
+    name?: string;
+    engines?: {
+        node?: string;
+    };
+}, cwd: string): void;
 /**
  * Marks the start and end of a function execution for performance measurement.
  * Uses the Performance API to create marks and measure the duration.

package/build/utils/credentials.d.mts

@@ -8,9 +8,9 @@
 export declare const KEYRING_SERVICE = "mui-code-infra";
 /**
  * @param {string} key
- * @returns {Promise<string | undefined>}
+ * @returns {Promise<string | null>}
  */
-export declare function getPassword(key: string): Promise<string | undefined>;
+export declare function getPassword(key: string): Promise<string | null>;
 /**
  * @param {string} key
  * @param {string} password

package/build/utils/git.d.mts

@@ -13,22 +13,18 @@ export type RepoInfo = {
     remoteName: string;
 };
 /**
- * @typedef {Object} RepoInfo
- * @property {string} owner - Repository owner
- * @property {string} repo - Repository name
- * @property {string} remoteName - Remote name
- */
-/**
- * Get current repository info from git remote
+ * The canonical repository's remote, as opposed to a fork's: `upstream`, else `origin`, each only if
+ * it points at a mui repository. Reads the configured URLs, which `insteadOf` does not rewrite.
  * @param {string} [cwd=process.cwd()]
- * @returns {Promise<RepoInfo>} Repository owner and name
+ * @returns {Promise<RepoInfo>}
  */
 export declare function getRepositoryInfo(cwd?: string): Promise<RepoInfo>;
 /**
  * Get current git SHA
+ * @param {string} [cwd=process.cwd()]
  * @returns {Promise<string>} Current git commit SHA
  */
-export declare function getCurrentGitSha(): Promise<string>;
+export declare function getCurrentGitSha(cwd?: string): Promise<string>;
 /**
  * Check whether a tag already exists on the origin remote
  * @param {string} tagName - Tag name to check (e.g. `v1.2.3`)
@@ -36,3 +32,28 @@ export declare function getCurrentGitSha(): Promise<string>;
  * @returns {Promise<boolean>} True if the tag exists on origin
  */
 export declare function remoteGitTagExists(tagName: string, cwd?: string): Promise<boolean>;
+/**
+ * The commit HEAD should be compared against: where it forked from the base branch, or its parent
+ * when HEAD is already on the base branch.
+ * @param {Object} [options]
+ * @param {string} [options.cwd]
+ * @param {string} [options.remote] - Defaults to the canonical remote.
+ * @param {string} [options.baseBranch] - Defaults to the remote's default branch.
+ * @returns {Promise<string>}
+ */
+export declare function resolveBaseline(options?: {
+    cwd?: string;
+    remote?: string;
+    baseBranch?: string;
+}): Promise<string>;
+/**
+ * The most recent version tag reachable from HEAD — where a changelog's range starts.
+ * @param {Object} opts
+ * @param {string} opts.cwd
+ * @param {boolean} [opts.fetchAll=true] Whether to fetch all tags from all remotes before finding the latest tag.
+ * @returns {Promise<string>}
+ */
+export declare function findLatestTaggedVersion(opts: {
+    cwd: string;
+    fetchAll?: boolean;
+}): Promise<string>;

package/build/utils/github.d.mts

@@ -47,3 +47,11 @@ export declare function endToEndGhAuthGetToken({ log }?: {
  * @returns {Promise<void>}
  */
 export declare function clearGitHubAuth(): Promise<void>;
+/**
+ * Returns when a rate-limited request may be retried, or `null` for other errors.
+ * https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api#exceeding-the-rate-limit
+ *
+ * @param {unknown} error
+ * @returns {Date | null}
+ */
+export declare function getRateLimitRetryTime(error: unknown): Date | null;

package/build/utils/pnpm.d.mts

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+/** Version that `publish-new-package` publishes to reserve the name of a new package. */
+export declare const PLACEHOLDER_VERSION = "0.0.1";
 export type PrivatePackage = {
     /**
      * - Package name
@@ -134,6 +136,53 @@ export declare function getReleaseVersion(cwd?: string): Promise<string | null>;
  * @returns {Promise<PublicPackage[]>} The subset needing a manual first publish
  */
 export declare function getPackagesNeedingManualPublish(packages: PublicPackage[]): Promise<PublicPackage[]>;
+export type RegistryPackage = {
+    /**
+     * - Dist-tags of the package
+     */
+    distTags: Record<string, string>;
+    /**
+     * - Published versions of the package
+     */
+    versions: string[];
+};
+/**
+ * @typedef {Object} RegistryPackage
+ * @property {Record<string, string>} distTags - Dist-tags of the package
+ * @property {string[]} versions - Published versions of the package
+ */
+/**
+ * Read the dist-tags and the published versions of each package with `pnpm view`, so
+ * the lookup uses the same registry configuration and credentials as `pnpm publish`.
+ *
+ * @param {PublicPackage[]} packages - Packages to read
+ * @returns {Promise<Map<string, RegistryPackage | null>>} By package name, null for a package that is not on the registry
+ */
+export declare function getRegistryPackages(packages: PublicPackage[]): Promise<Map<string, RegistryPackage | null>>;
+export type DistTagConflict = {
+    /**
+     * - Package to publish
+     */
+    pkg: PublicPackage;
+    /**
+     * - Why the dist-tag would move to the wrong release line
+     */
+    reason: string;
+};
+/**
+ * @typedef {Object} DistTagConflict
+ * @property {PublicPackage} pkg - Package to publish
+ * @property {string} reason - Why the dist-tag would move to the wrong release line
+ */
+/**
+ * Find the packages whose publish with `tag` would move the dist-tag to the wrong release line.
+ *
+ * @param {PublicPackage[]} packages - Packages to publish
+ * @param {string} tag - Dist-tag to publish with
+ * @param {Map<string, RegistryPackage | null>} registryPackages - Registry data from {@link getRegistryPackages}
+ * @returns {DistTagConflict[]}
+ */
+export declare function getDistTagConflicts(packages: PublicPackage[], tag: string, registryPackages: Map<string, RegistryPackage | null>): DistTagConflict[];
 /**
  * Get package version info from registry.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mui/internal-code-infra",
-  "version": "0.1.1-canary.2",
+  "version": "0.1.1-canary.21",
   "author": "MUI Team",
   "description": "Infra scripts and configs to be used across MUI repos.",
   "license": "MIT",
@@ -53,42 +53,45 @@
     "code-infra": "./bin/code-infra.mjs"
   },
   "dependencies": {
-    "@argos-ci/core": "6.8.4",
-    "@babel/cli": "^8.0.5",
-    "@babel/core": "^8.0.5",
+    "@argos-ci/core": "6.8.8",
+    "@babel/cli": "^8.0.6",
+    "@babel/core": "^8.0.7",
+    "@babel/helper-compilation-targets": "^8.0.7",
     "@babel/plugin-syntax-jsx": "^8.0.1",
-    "@babel/plugin-syntax-typescript": "^8.0.1",
+    "@babel/plugin-syntax-typescript": "^8.0.3",
     "@babel/plugin-transform-react-pure-annotations": "^8.0.1",
-    "@babel/plugin-transform-runtime": "^8.0.1",
-    "@babel/preset-env": "^8.0.5",
+    "@babel/plugin-transform-runtime": "^8.0.6",
+    "@babel/preset-env": "^8.0.7",
     "@babel/preset-react": "^8.0.1",
-    "@babel/preset-typescript": "^8.0.1",
+    "@babel/preset-typescript": "^8.0.7",
     "@eslint/compat": "^2.1.1",
     "@eslint/js": "^10.0.1",
-    "@eslint/json": "^2.1.0",
-    "@inquirer/confirm": "^6.3.2",
-    "@inquirer/select": "^5.2.5",
-    "@mui/internal-babel-plugin-display-name": "2.0.1-canary.0",
-    "@mui/internal-babel-plugin-minify-errors": "3.0.1-canary.0",
-    "@mui/internal-babel-plugin-resolve-imports": "3.0.1-canary.0",
-    "@napi-rs/keyring": "^2.0.0",
+    "@eslint/json": "^2.1.1",
+    "@inquirer/confirm": "^6.3.3",
+    "@inquirer/select": "^5.2.6",
+    "@mui/internal-babel-plugin-display-name": "2.0.1-canary.2",
+    "@mui/internal-babel-plugin-minify-errors": "3.0.1-canary.2",
+    "@mui/internal-babel-plugin-resolve-imports": "3.0.1-canary.3",
+    "@napi-rs/keyring": "^2.1.1",
     "@octokit/auth-action": "^6.0.3",
     "@octokit/oauth-methods": "^6.0.5",
+    "@octokit/plugin-retry": "^8.1.1",
+    "@octokit/plugin-throttling": "^11.0.5",
     "@octokit/rest": "^22.0.1",
-    "@pnpm/config.version-policy": "^1100.2.3",
+    "@pnpm/config.version-policy": "^1100.2.8",
     "@pnpm/find-workspace-dir": "^1000.1.5",
     "@pnpm/parse-wanted-dependency": "^1001.0.0",
-    "@typescript-eslint/types": "^8.70.0",
-    "@typescript-eslint/utils": "^8.70.0",
+    "@typescript-eslint/types": "^8.71.2",
+    "@typescript-eslint/utils": "^8.71.2",
     "@vitest/eslint-plugin": "^1.6.27",
     "babel-plugin-optimize-clsx": "^2.6.2",
     "babel-plugin-react-compiler": "^1.0.0",
-    "babel-plugin-transform-import-meta": "^3.0.0",
+    "babel-plugin-transform-import-meta": "^3.1.0",
     "babel-plugin-transform-react-remove-prop-types": "^0.4.24",
     "babel-plugin-transform-remove-imports": "^1.8.1",
-    "chalk": "^6.0.0",
+    "chalk": "^6.0.1",
     "clipboardy": "^5.3.2",
-    "content-type": "^3.1.0",
+    "content-type": "^3.1.1",
     "env-ci": "^11.2.0",
     "es-toolkit": "^1.52.0",
     "eslint-config-prettier": "^10.1.8",
@@ -98,19 +101,20 @@
     "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-jsx-a11y": "^6.10.2",
     "eslint-plugin-mdx": "^3.8.1",
+    "eslint-plugin-package-json": "^1.10.1",
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-react-compiler": "^19.1.0-rc.2",
     "eslint-plugin-react-hooks": "^7.1.1",
     "eslint-plugin-testing-library": "^7.16.2",
-    "execa": "^10.0.1",
+    "execa": "^10.1.1",
     "git-url-parse": "^16.1.0",
-    "globals": "^17.12.0",
+    "globals": "^17.13.0",
     "globby": "^16.2.4",
-    "html-validate": "^11.15.0",
+    "html-validate": "^11.16.2",
     "minimatch": "^10.2.6",
     "node-html-parser": "^9.0.4",
-    "open": "^11.0.3",
-    "postcss-styled-syntax": "^0.7.2",
+    "open": "^11.0.4",
+    "postcss-styled-syntax": "^0.7.4",
     "regexp.escape": "^2.0.1",
     "rehype-slug": "^6.0.0",
     "rehype-stringify": "^10.0.1",
@@ -133,12 +137,12 @@
     "resolve-pkg-maps": "^1.0.0",
     "semver": "^7.8.5",
     "stylelint-config-standard": "^40.0.0",
-    "typescript-eslint": "^8.70.0",
+    "typescript-eslint": "^8.71.2",
     "unified": "^11.0.5",
     "unified-lint-rule": "^3.0.1",
     "unist-util-visit": "^5.1.0",
     "yaml": "^2.9.1",
-    "yargs": "^18.1.0"
+    "yargs": "^18.2.0"
   },
   "peerDependencies": {
     "@next/eslint-plugin-next": "*",
@@ -162,17 +166,16 @@
     "@types/mdast": "4.0.4",
     "@types/regexp.escape": "2.0.0",
     "@types/yargs": "17.0.35",
-    "@typescript-eslint/parser": "8.70.0",
-    "@typescript-eslint/rule-tester": "8.70.0",
+    "@typescript-eslint/parser": "8.71.2",
+    "@typescript-eslint/rule-tester": "8.71.2",
     "@typescript/native": "npm:typescript@7.0.2",
-    "eslint": "10.10.0",
+    "eslint": "10.12.0",
     "get-port": "7.2.0",
-    "prettier": "3.9.6",
+    "prettier": "3.9.10",
     "remark": "15.0.1",
     "remark-mdx": "3.1.1",
     "serve": "14.2.6",
-    "typescript": "npm:@typescript/typescript6@6.0.2",
-    "typescript-eslint": "8.70.0"
+    "typescript": "npm:@typescript/typescript6@6.0.2"
   },
   "files": [
     "bin",
@@ -187,7 +190,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitSha": "342a1159c5c25a48c8ed853893146aa8701574a6",
+  "gitSha": "e8aec3f286672d4639af7b385ef313c3d8ec74f3",
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "typescript": "tsc -noEmit",

package/src/changelog/fetchChangelogs.mjs

@@ -1,9 +1,25 @@
+import { retry } from '@octokit/plugin-retry';
+import { throttling } from '@octokit/plugin-throttling';
 import { Octokit } from '@octokit/rest';
-import { $ } from 'execa';
+import { mapAsync } from 'es-toolkit/array';
 
-import { getRepositoryInfo } from '../utils/git.mjs';
 import { persistentAuthStrategy } from '../utils/github.mjs';
 
+const ThrottledOctokit = Octokit.plugin(throttling, retry);
+
+/**
+ * Waits out short rate limits. Longer ones fail with the original error.
+ *
+ * @param {number} retryAfter - Seconds until the request may be retried
+ * @param {unknown} options
+ * @param {unknown} octokit
+ * @param {number} retryCount
+ * @returns {boolean}
+ */
+function shouldRetryRateLimit(retryAfter, options, octokit, retryCount) {
+  return retryAfter <= 60 && retryCount < 3;
+}
+
 /**
  * @typedef {import('@octokit/rest').Octokit} OctokitType
  */
@@ -18,27 +34,9 @@ import { persistentAuthStrategy } from '../utils/github.mjs';
  * @property {string} lastRelease
  * @property {string} release
  * @property {string} [org='mui'] - GitHub organization name, defaults to 'mui'
+ * @property {(progress: { phase: string; count: number; total: number }) => void} [onProgress] - Called as commits are listed and their pull request details are fetched
  */
 
-/**
- * @param {Object} opts
- * @param {string} opts.cwd
- * @param {boolean} [opts.fetchAll=true] Whether to fetch all tags from all remotes before finding the latest tag.
- * @returns {Promise<string>}
- */
-export async function findLatestTaggedVersion(opts) {
-  const $$ = $({ cwd: opts.cwd });
-  const fetchAll = opts.fetchAll ?? true;
-  if (fetchAll) {
-    const { remoteName } = await getRepositoryInfo();
-    // Fetch all tags from the mui remote to ensure we have the latest tags.
-    // --force to update any existing tags that may have changed to avoid the clobering error.
-    await $$`git fetch --tags --force ${remoteName}`;
-  }
-  const { stdout } = await $$`git describe --tags --abbrev=0 --match ${'v*'}`; // only include "version-tags"
-  return stdout.trim();
-}
-
 /**
  * Fetches commits between two refs (lastRelease..release) including PR details.
  * Automatically handles GitHub OAuth authentication if none provided.
@@ -50,7 +48,13 @@ export async function fetchCommitsBetweenRefs(opts) {
   const octokit =
     'octokit' in opts && opts.octokit
       ? opts.octokit
-      : new Octokit({ authStrategy: persistentAuthStrategy });
+      : new ThrottledOctokit({
+          authStrategy: persistentAuthStrategy,
+          throttle: {
+            onRateLimit: shouldRetryRateLimit,
+            onSecondaryRateLimit: shouldRetryRateLimit,
+          },
+        });
 
   return fetchCommitsRest({
     octokit,
@@ -58,6 +62,7 @@ export async function fetchCommitsBetweenRefs(opts) {
     lastRelease: opts.lastRelease,
     release: opts.release,
     org: opts.org ?? 'mui',
+    onProgress: opts.onProgress,
   });
 }
 
@@ -70,7 +75,7 @@ export async function fetchCommitsBetweenRefs(opts) {
  *
  * @returns {Promise<FetchedCommitDetails[]>}
  */
-async function fetchCommitsRest({ octokit, repo, lastRelease, release, org = 'mui' }) {
+async function fetchCommitsRest({ octokit, repo, lastRelease, release, org = 'mui', onProgress }) {
   /**
    * @typedef {Awaited<ReturnType<Octokit['repos']['compareCommits']>>['data']['commits']} Commits
    */
@@ -90,9 +95,19 @@ async function fetchCommitsRest({ octokit, repo, lastRelease, release, org = 'mu
   );
   for await (const response of timeline) {
     results.push(...response.data.commits);
+    onProgress?.({
+      phase: 'Listing commits',
+      count: results.length,
+      total: response.data.total_commits,
+    });
   }
 
-  const promises = results.map(async (commit) => {
+  /**
+   * @param {Commits[number]} commit
+   * @param {AbortSignal} signal
+   * @returns {Promise<FetchedCommitDetails | null>}
+   */
+  const fetchCommitDetails = async (commit, signal) => {
     const matches = [...commit.commit.message.matchAll(/#(\d+)/g)];
     // The PR number is always the last match.
     // Sometimes the PR titles include an issue number like this:
@@ -111,6 +126,7 @@ async function fetchCommitsRest({ octokit, repo, lastRelease, release, org = 'mu
       headers: {
         Accept: 'application/vnd.github.text+json',
       },
+      request: { signal },
     });
 
     const labels = pr.data.labels.map((label) => label.name);
@@ -132,9 +148,33 @@ async function fetchCommitsRest({ octokit, repo, lastRelease, release, org = 'mu
       prTitle: pr.data.title,
       prBody: pr.data.body,
     });
-  });
+  };
+
+  // `mapAsync` rejects on the first error but still runs every queued callback.
+  // Aborted once it settles, which cancels requests in flight and skips the ones not started yet.
+  const controller = new AbortController();
 
-  return (await Promise.all(promises)).filter((entry) => entry !== null);
+  let fetched = 0;
+  try {
+    const commits = await mapAsync(
+      results,
+      async (commit) => {
+        if (controller.signal.aborted) {
+          return null;
+        }
+        const details = await fetchCommitDetails(commit, controller.signal);
+        if (!controller.signal.aborted) {
+          fetched += 1;
+          onProgress?.({ phase: 'Fetching pull requests', count: fetched, total: results.length });
+        }
+        return details;
+      },
+      { concurrency: 10 },
+    );
+    return commits.filter((entry) => entry !== null);
+  } finally {
+    controller.abort();
+  }
 }
 
 /**