@oakoss/oakum 0.6.0 → 0.6.2

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## 0.6.2 (2026-10-23)
+
+### Fixed
+
+`version` finishes a pre-release instead of skipping past it. A patch bump on `2.0.0-rc.1` now gives `2.0.0` rather than `2.0.1`; a minor bump on `2.1.0-rc.1` gives `2.1.0`, and a major bump on `2.0.0-rc.1` gives `2.0.0`. A bump that leaves the line the pre-release was heading toward still moves past it: a minor bump on `2.1.3-rc.1` gives `2.2.0`. This matches node-semver's `inc`, which changesets uses. Under the default `versioning = "zero-major"`, a major below 1.0.0 is still read as a minor first, so a major bump on `0.3.0-rc.1` gives `0.3.0`; under `versioning = "semver"` it gives `1.0.0`.
+
+Discovery no longer writes `pnpm-lock.yaml` into a lock-free pnpm workspace that declares its package manager. pnpm 11 wrote one despite `--config.lockfile=false` under a `devEngines.packageManager` naming a version it accepted, and under a `packageManager` naming a newer pnpm; pnpm 12 did when a `devEngines.packageManager` switched it to an 11. Discovery now has the pnpm on `PATH` answer, so a declaration pnpm would refuse, such as a `devEngines.packageManager` array or `onFail: "error"` naming another pnpm, no longer stops discovery.
+
+The workflow `init` and `migrate` print now takes the pnpm version from a `devEngines.packageManager` array that names an exact one, since `pnpm/action-setup` reads only the object form, instead of asking pnpm. An array naming a pnpm other than the one on `PATH` gets that pnpm as the workflow's `version` input rather than exiting `unverified`. An array whose version is not an exact one, such as a range, still asks pnpm, which under pnpm 11 can write a lockfile when the version matches it.
+
+In a pnpm workspace, a dependency whose range the same-named member's current version does not satisfy, such as `"is-number": "7.0.0"` beside a workspace member `is-number` at `1.0.0`, is no longer read as depending on that member. pnpm installs it from the registry, yet `version` rewrote it to the member's new version on a release that left the range. This covers plain ranges, `npm:` aliases and `catalog:` entries; a `workspace:` dependency still always counts as depending on the member.
+
+`oakum ci pr-status --emit-comment <dir>` no longer writes the comment file when `pr-status = "summary"`. It wrote `oakum-pr-comment.md` anyway, so a trusted job that posts whatever it finds there posted a comment the config had turned off. It now writes the job summary as configured, removes a comment file left by an earlier run, says on stderr that `summary` turned the comment off, and exits 0.
+
+The `leftover tag ambiguity` refusal from `check`, `version` and `release` now says how to resolve it, on a line after the tags it names:
+
+- Two versions of one package tagged on one commit: keep the tag for the version that commit's manifest names and delete the other, on the remote too if it was pushed.
+- A bare `v<version>` tag with several packages tagged: use `<package>/v<version>`.
+- A version-like tag in a shape oakum does not read: rename it to one it does.
+- A tag naming a package the workspace no longer has, as after a rename: delete it, or tag the release with a current package's name.
+- A tag whose package name exists in two ecosystems: rename the package it did not release.
+
+The refusal and its exit code are unchanged, and so is the `summary` of its `check --json` refusal, which keeps the first line only.
+
+## 0.6.1 (2026-10-23)
+
+### Fixed
+
+Errors, warnings, prompts, and the summaries `oakum status` and `oakum version` print now escape bytes that could rewrite the terminal, such as an escape sequence or a bidi override in a bump file's name or a pnpm package name. So does the plan `oakum ci pr-status` prints to stdout when `GITHUB_STEP_SUMMARY` is unset; the job summary file keeps the text as rendered. Before, only some messages did: `oakum status` printed a bump file's name raw when refusing it, and the summaries printed such names raw. Error text quoted from pnpm, cargo, git or the old release tool prints without its colour codes. Combining accents print as written rather than as `\u{301}`. Output meant for scripts is unchanged: `--json`, and the paths, URLs and tags that commands print as their result.
+
+`oakum migrate` runs bumpy, changesets and knope under `OAKUM_REMOTE_DEADLINE` like every other child: one whose answer has not arrived by then is named, and `migrate` exits `2` (unverified) instead of hanging.
+
+`migrate` also finds those tools on `PATH` the way discovery finds pnpm, including a Git Bash `PATH` on Windows (`/c/Users/...`, or `:`-separated entries), which its lookup used to miss.
+
+Both lookups now share one reading of `PATH`. On Windows, a quoted entry such as `"C:\Program Files\knope"` and a verbatim one such as `\\?\C:\tools` are each one directory, and only a name with a `PATHEXT` extension is taken, never an extensionless file. Elsewhere, `PATH` is read as the shell reads it, so `/a/bin` is a directory rather than drive `A:` and a bare `pnpm` wins over a `pnpm.EXE` beside it. On every system an empty `PATH` entry is skipped rather than read as the current directory, so it no longer runs a `pnpm`, `bumpy`, `changeset` or `knope` file from the repository being inspected.
+
+Four messages now say what to do:
+
+- A version no tag records (`never released, but the manifest is 1.0.0`) names the tag to cut, rendered from `tag-format` or the default: `` `git tag @demo/a/v1.0.0 <commit>` ``. A `tag-format` whose tag oakum could not read back as that version names none.
+- In `oakum check`, a change with no covering intent names `oakum add --packages <package>:<level>`, and, when conventional commits are on, `oakum generate --from <base>` over the range `check` read.
+- `oakum add` without `--message` says the bump file's changelog entry will be empty.
+- `oakum init` and `oakum migrate` say why they reach GitHub when the lookup for the printed workflow's action pins fails, and that nothing was written.
+
 ## 0.6.0 (2026-10-23)
 
 ### Added
@@ -310,4 +353,4 @@ Release workflow checks out the homebrew tap in a subdirectory so the composite
 
 Self-host release CI uploads cargo-dist artifacts into the GitHub Release oakum already created, instead of calling create again.
 
-Generated by oakum 0.5.1.
+Generated by oakum 0.6.1.

package/npm-shrinkwrap.json

@@ -19,7 +19,7 @@
       "hasInstallScript": true,
       "license": "MIT",
       "name": "@oakoss/oakum",
-      "version": "0.6.0"
+      "version": "0.6.2"
     },
     "node_modules/detect-libc": {
       "engines": {
@@ -48,5 +48,5 @@
     }
   },
   "requires": true,
-  "version": "0.6.0"
+  "version": "0.6.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/oakoss/oakum/releases/download/v0.6.0"
+    "https://github.com/oakoss/oakum/releases/download/v0.6.2"
   ],
   "author": "Jace Babin",
   "bin": {
@@ -105,7 +105,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.6.0",
+  "version": "0.6.2",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"