@oakoss/oakum 0.5.1 → 0.6.1

package/CHANGELOG.md

@@ -1,5 +1,52 @@
 # Changelog
 
+## 0.6.1 (2026-10-23)
+
+### Fixed
+
+Errors, warnings, prompts, and the summaries `oakum status` and `oakum version` print now escape bytes that could rewrite the terminal, such as an escape sequence or a bidi override in a bump file's name or a pnpm package name. So does the plan `oakum ci pr-status` prints to stdout when `GITHUB_STEP_SUMMARY` is unset; the job summary file keeps the text as rendered. Before, only some messages did: `oakum status` printed a bump file's name raw when refusing it, and the summaries printed such names raw. Error text quoted from pnpm, cargo, git or the old release tool prints without its colour codes. Combining accents print as written rather than as `\u{301}`. Output meant for scripts is unchanged: `--json`, and the paths, URLs and tags that commands print as their result.
+
+`oakum migrate` runs bumpy, changesets and knope under `OAKUM_REMOTE_DEADLINE` like every other child: one whose answer has not arrived by then is named, and `migrate` exits `2` (unverified) instead of hanging.
+
+`migrate` also finds those tools on `PATH` the way discovery finds pnpm, including a Git Bash `PATH` on Windows (`/c/Users/...`, or `:`-separated entries), which its lookup used to miss.
+
+Both lookups now share one reading of `PATH`. On Windows, a quoted entry such as `"C:\Program Files\knope"` and a verbatim one such as `\\?\C:\tools` are each one directory, and only a name with a `PATHEXT` extension is taken, never an extensionless file. Elsewhere, `PATH` is read as the shell reads it, so `/a/bin` is a directory rather than drive `A:` and a bare `pnpm` wins over a `pnpm.EXE` beside it. On every system an empty `PATH` entry is skipped rather than read as the current directory, so it no longer runs a `pnpm`, `bumpy`, `changeset` or `knope` file from the repository being inspected.
+
+Four messages now say what to do:
+
+- A version no tag records (`never released, but the manifest is 1.0.0`) names the tag to cut, rendered from `tag-format` or the default: `` `git tag @demo/a/v1.0.0 <commit>` ``. A `tag-format` whose tag oakum could not read back as that version names none.
+- In `oakum check`, a change with no covering intent names `oakum add --packages <package>:<level>`, and, when conventional commits are on, `oakum generate --from <base>` over the range `check` read.
+- `oakum add` without `--message` says the bump file's changelog entry will be empty.
+- `oakum init` and `oakum migrate` say why they reach GitHub when the lookup for the printed workflow's action pins fails, and that nothing was written.
+
+## 0.6.0 (2026-10-23)
+
+### Added
+
+`check` now reports `.changeset/_schema.json` when its bytes differ from what the running oakum generates, or when it cannot be read, whatever `_config.toml`'s `#:schema` line says; a missing one is reported only when that line names it. The stale and missing notes name `oakum upgrade`, after settling the install pins when they disagree, cannot be read, or are not exact versions. When the install pins agree on a version other than the running binary's, `check` does not compare and says so, naming both versions. Each note is a stderr line and, under `--json`, a `schema` look with outcome `reported`; a current schema, or an absent one the config does not name, reads `ok` and adds nothing. The exit code does not change in any case, `--strict` included: the binary validates the config on every run, so a stale schema affects editor hints only. The `check` scope line now lists `schema` among the looks.
+
+### Changed
+
+The workflow `oakum init` and `oakum migrate` print for a Cargo repository pins `taiki-e/install-action` to v2.87.30 (was v2.87.22).
+
+oakum reads its version from the install pin, not `tool-version` (ADR-0038). `add`, `generate`, `version`, `ci version-pr`, `release`, `upgrade`, `init`, and `migrate` compare this binary to the version pinned in `.github/workflows`, a composite action under `.github/actions`, `package.json`, `.mise.toml` or `mise.toml`, or a Cargo workspace member named `oakum`, and refuse with exit 1 when they differ, naming the fix for that direction. `add`, `generate`, `version`, and `ci version-pr` refuse with exit 2 when nothing pins oakum, when pins disagree, or when a pin cannot be read or is a range such as `^0.5.0`; a repository that relied on `tool-version` alone with a global or Homebrew install now needs a pin: `pnpm add -D --allow-build=@oakoss/oakum @oakoss/oakum@<version>`, or `"github:oakoss/oakum" = "<version>"` under `[tools]` in `.mise.toml`. A symlink to a missing target where a pin source would be is unverified, as a pin that cannot be read is, not read as no pin; `check` included. `upgrade` refuses with exit 2 when pins disagree or cannot be read; when nothing pins oakum it continues and says so on stderr. `release` leaves a missing or unsettled pin to its install-pin precondition, as before. `init` and `migrate` check the pin on every run, a fresh repository included, and write their files whatever the pin says unless it names another version: with no pin they print the pin as the next step and exit 0, pointing at the printed workflow's install line when it has one, and when pins disagree or cannot be read they print that and exit 2 after writing. `check` passes pins that agree with each other whatever `tool-version` says, and reads `github:oakoss/oakum` as a pin. A Cargo workspace member named `oakum` is found wherever Cargo finds it, member globs of any shape and a path dependency Cargo makes a member included, so a repository that got exit 2 for an unsupported `workspace.members` glob now passes, or gets exit 1 when its pin really differs; the member is read from the repository root with `cargo metadata`, so a Cargo workspace it cannot read (no `cargo` on `PATH`, a listed member missing) is an unread pin source, exit 2 unless other pins name another version. `init` and `migrate` no longer write `tool-version` into the `_config.toml` they create, and `version` no longer rewrites it when it bumps a Cargo workspace member named `oakum`. `_config.toml` may omit `tool-version`, and any value in it parses, a range included: nothing reads it, and the schema no longer requires it. `upgrade` removes `tool-version` from `_config.toml` in whatever shape it takes, keeping comments, including a `#:schema` line above it, and the rest of the file; it no longer writes or reports a version, and its message when nothing changed no longer names one. While the key is present, every command that loads the config except `upgrade` prints one stderr line saying oakum no longer reads it and naming `oakum upgrade`; exit codes and stdout are unchanged. The version-PR body and changelog footer stamp this binary's version.
+
+oakum reads npm ranges with js-semver 1.0. A dependency range with `==` before a full version, such as `==1.0.0`, is now refused, as pnpm and node-semver refuse it; oakum read it as `1.0.0` before. `==` before a partial version, such as `==1`, still reads as before. The refusal for an unreadable range names what is wrong, such as `unexpected character '=' while parsing major version`, instead of `invalid number`.
+
+Templates render with minijinja 3, which follows Jinja2 more closely, so a template you write can render differently or fail where it rendered before. The main differences: a printed list or map uses single quotes (`['a', 'b']`), and `zip` and `items` give tuples that print as `(1, 3)`; `round` rounds half to even (`2.5` gives `2.0`); `title` leaves the letter after an apostrophe lowercase (`Don't`); `max` and `min` compare strings ignoring case; a boolean passes `is number`; unary minus binds as in Jinja2 (`-a.b` negates `a.b`); dividing by zero and `format` with an undefined value fail the render instead of printing `inf` or nothing. An undefined variable's error names the expression, such as `` `name` is undefined ``, before oakum's list of what the template receives. Built-in templates render the same. minijinja's [3.0.0 release notes](https://github.com/mitsuhiko/minijinja/releases/tag/3.0.0) list every change.
+
+Building oakum from source needs Rust 1.99.1 (was 1.98.1).
+
+### Fixed
+
+An empty pnpm catalog entry (`''`, `' '`, or an empty block scalar such as `|`) now reads as matching any version, as pnpm installs it. A bump of the package it names leaves the entry empty instead of failing `version` with `inherited pin ... is not a single-operator range`, and an empty block scalar no longer fails discovery as an unresolved catalog entry.
+
+`version` and `ci version-pr` now rewrite the `pnpm-lock.yaml` entries a workspace range rewrite invalidates, so a frozen install (`pnpm install --frozen-lockfile`, or any install under `CI=true`) accepts the lockfile they leave. An entry they cannot rewrite, for example because the lockfile had already drifted from the manifest or the range resolves from the registry, is left as it was and named on stderr with `pnpm install` as the fix; `ci version-pr` also lists it in the version pull request body. A lockfile in a format oakum has not measured is left whole and named the same way.
+
+Update saphyr-parser, the YAML event parser behind in-place catalog and lockfile rewrites, from 0.0.12 to 0.2. Rewrites are unchanged. A `pnpm-lock.yaml` the parser rejects, such as one holding a NUL byte, is now named as unparsable rather than as using YAML anchors.
+
+Update rustls-webpki to 0.103.16 and webpki-root-certs to 1.0.10 for RUSTSEC-2026-0382 and RUSTSEC-2026-0383, which let certificate verification trust distrusted emSign intermediates.
+
 ## 0.5.1 (2026-10-15)
 
 ### Fixed
@@ -282,4 +329,4 @@ Release workflow checks out the homebrew tap in a subdirectory so the composite
 
 Self-host release CI uploads cargo-dist artifacts into the GitHub Release oakum already created, instead of calling create again.
 
-Generated by oakum 0.5.0.
+Generated by oakum 0.6.0.

package/README.md

@@ -6,7 +6,7 @@ Oakum is the tarred fiber driven into the seams between a ship's planks to keep
 
 [![crates.io](https://img.shields.io/crates/v/oakum)](https://crates.io/crates/oakum) [![npm](https://img.shields.io/npm/v/@oakoss/oakum)](https://www.npmjs.com/package/@oakoss/oakum)
 
-**Status:** Published on crates.io, [Homebrew](https://github.com/oakoss/homebrew-tap), and npm (`@oakoss/oakum`); see [releases](https://github.com/oakoss/oakum/releases). Zero-major versioning below 1.0.0 ([ADR-0022](docs/decisions/0022-zero-major-versioning.md)) — APIs and defaults can still change; pin `tool-version` in `.changeset/_config.toml`.
+**Status:** Published on crates.io, [Homebrew](https://github.com/oakoss/homebrew-tap), and npm (`@oakoss/oakum`); see [releases](https://github.com/oakoss/oakum/releases). Zero-major versioning below 1.0.0 ([ADR-0022](docs/decisions/0022-zero-major-versioning.md)) — APIs and defaults can still change; pin an exact version where you install oakum (a `package.json` devDependency, a workflow install line, or `.mise.toml`), which is the version oakum enforces ([ADR-0038](docs/decisions/0038-the-install-pin-is-the-version.md)).
 
 ## What it does that other tools don't
 
@@ -18,9 +18,9 @@ Oakum derives which is which — from the binary targets Cargo resolves for a pa
 
 ## Design rules
 
-**Config expresses preference; facts are derived.** What depends on what, what is publishable, what needs a bump, and which artifact ships are all read from the repository on every run. Templates, titles, the tag format oakum writes, and commit messages are yours, because they describe output rather than the repository, so they cannot go stale. Two keys are neither: `tool-version`, which pins the binary allowed to run, and `resolves-dependencies-at`, which states when your package manager fixes a dependency — a fact about the ecosystem that oakum cannot read from your repository. `init` and `upgrade` will write `_schema.json` next to `_config.toml` and a `#:schema ./_schema.json` line; that directive is taplo's, not part of TOML, so editor support varies.
+**Config expresses preference; facts are derived.** What depends on what, what is publishable, what needs a bump, and which artifact ships are all read from the repository on every run. Templates, titles, the tag format oakum writes, and commit messages are yours, because they describe output rather than the repository, so they cannot go stale. One key is neither: `resolves-dependencies-at`, which states when your package manager fixes a dependency — a fact about the ecosystem that oakum cannot read from your repository. `init` and `upgrade` will write `_schema.json` next to `_config.toml` and a `#:schema ./_schema.json` line; that directive is taplo's, not part of TOML, so editor support varies.
 
-**Every command writes only the files it owns.** Oakum does not install git hooks, touch git config, edit `AGENTS.md`, write CI workflows, or create commits you did not ask for. `version` owns the manifests it bumps, the lockfile entries those bumps invalidate, declared `extra-files`, and — when the Cargo member named `oakum` is bumped — `tool-version` in `.changeset/_config.toml`. A Cargo version bump invalidates `Cargo.lock`, so leaving it stale would break the next `--locked` build. Nothing beyond that is written. `check` is pure: it reports drift and names the fix, never applies it.
+**Every command writes only the files it owns.** Oakum does not install git hooks, touch git config, edit `AGENTS.md`, write CI workflows, or create commits you did not ask for. `version` owns the manifests it bumps, the lockfile entries those bumps invalidate, and declared `extra-files`. A Cargo version bump invalidates `Cargo.lock`, and a rewritten workspace range invalidates its `pnpm-lock.yaml` entry, so leaving either stale would break the next `--locked` build or frozen install. Nothing beyond that is written. `check` is pure: it reports drift and names the fix, never applies it.
 
 **Failure is loud, and "we didn't look" is never reported as "it's fine."** Every verification has three outcomes, not two. A version that could not be confirmed says so.
 
@@ -30,7 +30,7 @@ Three install channels, one cargo-dist build behind all of them, so the versions
 
 - `cargo install oakum` — builds from crates.io
 - `brew install oakoss/tap/oakum`
-- `pnpm add -D @oakoss/oakum@<version>` — an exact version is what `oakum check` verifies against `tool-version`. The npm package is a fetcher, not a bundle: a small install script downloads the platform binary from the GitHub release. pnpm 10 and later run that script only for allowlisted packages. On pnpm 10 the allowlist is `pnpm.onlyBuiltDependencies` in `package.json`; without it pnpm warns `Ignored build scripts` and the first `pnpm exec oakum` fetches the binary instead. On pnpm 11 and later it is `allowBuilds: { '@oakoss/oakum': true }` in `pnpm-workspace.yaml` (pnpm 11 does not read the `pnpm` field of `package.json`), and without it `pnpm install` fails, so add it before the first install
+- `pnpm add -D --allow-build=@oakoss/oakum @oakoss/oakum@<version>` — the exact version is the install pin oakum enforces. The npm package is a fetcher, not a bundle: a small install script downloads the platform binary from the GitHub release, and pnpm 10 and later run that script only for approved packages. `--allow-build` writes that approval (`allowBuilds`). Without it pnpm 11 and later fail `pnpm add` and `pnpm install` with `ERR_PNPM_IGNORED_BUILDS`; pnpm 10 only warns, and the first `pnpm exec oakum` fetches the binary instead
 
 None of these works offline, and the npm channel needs **two** origins at install time — the registry for the package, then `github.com` for the binary. An environment with an internal npm mirror but no route to GitHub installs the package and then fails in `postinstall`; there, `cargo install oakum` through a crates.io mirror is the only channel that avoids GitHub entirely, since the shell installer and Homebrew fetch from the GitHub release too.
 

package/npm-shrinkwrap.json

@@ -19,7 +19,7 @@
       "hasInstallScript": true,
       "license": "MIT",
       "name": "@oakoss/oakum",
-      "version": "0.5.1"
+      "version": "0.6.1"
     },
     "node_modules/detect-libc": {
       "engines": {
@@ -48,5 +48,5 @@
     }
   },
   "requires": true,
-  "version": "0.5.1"
+  "version": "0.6.1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/oakoss/oakum/releases/download/v0.5.1"
+    "https://github.com/oakoss/oakum/releases/download/v0.6.1"
   ],
   "author": "Jace Babin",
   "bin": {
@@ -105,7 +105,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.5.1",
+  "version": "0.6.1",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"